The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new flaws to its Known Exploited Vulnerabilities Catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including a high-severity security flaw (
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
According to the US agency, Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation). An attacker can trigger the flaw to cause an out-of-bounds write and achieve code execution.
It is important to highlight that there are no security patches to fix this issue and that the impacted product is end-of-life.
CISA also added to the catalog a Sanbox Bypass Vulnerability, tracked as CVE-2021-31010 (CVSS score: 7.5), in Apple iOS, macOS, and watchOS.
“In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.” reads the advisory.
The other vulnerabilities added to the catalog are:
- CVE-2022-26352 – dotCMS Unrestricted Upload of File Vulnerability
- CVE-2022-24706 – Apache CouchDB Insecure Default Initialization of Resource Vulnerability
- CVE-2022-24112 – Apache APISIX Authentication Bypass Vulnerability
- CVE-2022-22963 – VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
- CVE-2022-2294 – WebRTC Heap Buffer Overflow Vulnerability
- CVE-2021-39226 – Grafana Authentication Bypass Vulnerability
- CVE-2020-36193 – PEAR Archive_Tar Improper Link Resolution Vulnerability
- CVE-2020-28949 – PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability
CISA orders federal agencies to fix these vulnerabilities by September 15, 2022.
CISA Cybersecurity Alerts
CyberWire Inc. (Author)Flash cybersecurity advisories from the US Government. These alerts provide timely technical and operational information, indicators of compromise, and mitigations for current major security threats, vulnerabilities, and exploits. These alerts have been edited and adapted for audio by The CyberWire as a public service.
Free podcast:
