CISA Listed Multiple Vulnerabilities

 THREAT HUNTER (GUARD YOUR DEVICE)

Vulnerability News #0002

January 24, 2022


Name News : Multiple Vulnerabilities form CISA

Affected System : Multiple Platform

Vulnerability Involved : As listed below

News Detail

The Cybersecurity and Infrastructure Security Agency (CISA) updated its 'Known Exploited Vulnerabilities Catalog' this week to include seventeen actively exploited vulnerabilities. The 'Known Exploited Vulnerabilities Catalog' is a catalog of vulnerabilities that have been exploited by threat actors in attacks and that FCEB agencies must patch. With the addition of these 17 vulnerabilities with a deadline for agencies to apply security upgrades to fix the flaw. The seventeen new vulnerabilities added this week are listed below:

  • CVE-2021-32648: October CMS Improper Authentication
  • CVE-2021-21315: System Information Library for node.js Command Injection Vulnerability
  • CVE-2021-21975: Server Side Request Forgery in vRealize Operations Manager API Vulnerability
  • CVE-2021-22991: BIG-IP Traffic Microkernel Buffer Overflow Vulnerability
  • CVE-2021-25296: Nagios XI OS Command Injection Vulnerability
  • CVE-2021-25297: Nagios XI OS Command Injection Vulnerability
  • CVE-2021-25298: Nagios XI OS Command Injection Vulnerability
  • CVE-2021-33766: Microsoft Exchange Server Information Disclosure Vulnerability
  • CVE-2021-40870: Aviatrix Controller Unrestricted Upload of File Vulnerability
  • CVE-2021-35247: SolarWinds Serv-U Improper Input Validation Vulnerability
  • CVE-2020-11978: Apache Airflow Command Injection Vulnerability
  • CVE-2020-13671: Drupal Core Unrestricted Upload of File Vulnerability
  • CVE-2020-13927: Apache Airflow Experimental API Authentication Bypass Vulnerability
  • CVE-2020-14864: Oracle Corporate Business Intelligence Enterprise Edition Path Traversal Vulnerability
  • CVE-2006-1547: Apache Struts 1 ActionForm Denial of Service Vulnerability
  • CVE-2012-0391: Apache Struts 2 Improper Input Validation Vulnerability
  • CVE-2018-8453: Microsoft Windows Win32k Privilege Escalation Vulnerability

Threat actors can use the vulnerabilities described in the catalog to steal credentials, obtain access to networks, remotely execute commands, download and execute malware, and collect information from devices, among other things. The researchers recommended patching the vulnerability.

Suggestion

Update to the latest patch.

Imprint

  • Allow threat actors to perform a variety of attacks, including stealing credentials, gaining access to networks, remotely executing commands, downloading and executing malware

  • Allow threat actors to steal information from devices.


References:


© SAS Threat Hunter 

Direct to sasmoza.enterprise Sdn. Bhd for Subscribing News

Comments

Post a Comment

Popular Posts