[ad_1]
The US Cybersecurity and Infrastructure Safety Company (CISA) has added 9 new flaws to its assortment of actively exploited vulnerabilities, together with two lately patched zero-days impacting Google Chrome and Adobe Commerce/Magento Open Supply.
The Chrome vulnerability (CVE-2022-0609) is a excessive severity use after free bug that can let attackers execute arbitrary code or escape the browser’s safety sandbox on computer systems working unpatched Chrome variations addressed in Chrome 98.0.4758.102.
Adobe launched an emergency replace to repair a crucial flaw (CVE-2022-24086) exploited within the wild “in very restricted assaults” to realize distant code execution utilizing exploits focusing on Adobe Commerce and Magento Open Supply variations 2.4.3-p1/2.3.7-p2.
eCommerce safety firm Sansec warned that the Magento flaw is much like the 2015 crucial bug Magento Shoplift which enabled menace actors to take over susceptible Magento websites.
CISA stated that each one Federal Civilian Govt Department Companies (FCEB) companies should deploy patches for these two safety vulnerabilities till March 1st, 2022.
The whole listing of 9 flaws added in the present day to CISA’s Recognized Exploited Vulnerabilities Catalog contains a mixture of outdated and new bugs, starting from 2013 to 2022, as proven within the desk under.
| CVE Quantity | CVE Title | Patch Deadline |
| CVE-2022-24086 | Adobe Commerce and Magento Open Supply Improper Enter Validation | 03/01/22 |
| CVE-2022-0609 | Google Chrome Use-After-Free | 03/01/22 |
| CVE-2019-0752 | Microsoft Web Explorer Sort Confusion | 08/15/22 |
| CVE-2018-8174 | Microsoft Home windows VBScript Engine Out-of-Bounds Write | 08/15/22 |
| CVE-2018-20250 | WinRAR Absolute Path Traversal | 08/15/22 |
| CVE-2018-15982 | Adobe Flash Participant Use-After-Free | 08/15/22 |
| CVE-2017-9841 | PHPUnit Command Injection | 08/15/22 |
| CVE-2014-1761 | Microsoft Phrase Reminiscence Corruption | 08/15/22 |
| CVE-2013-3906 | Microsoft Graphics Part Reminiscence Corruption | 08/15/22 |
Federal companies are required to patch their techniques in opposition to these actively exploited vulnerabilities, in response to a binding operational directive (BOD 22-01) issued by CISA in November 2021.
“A lot of these vulnerabilities are a frequent assault vector for malicious cyber actors of all kinds and pose important threat to the federal enterprise,” the cybersecurity company stated.
“Though BOD 22-01 solely applies to FCEB companies, CISA strongly urges all organizations to cut back their publicity to cyberattacks by prioritizing well timed remediation of Catalog vulnerabilities as a part of their vulnerability administration follow.”
Final week, the US cybersecurity company additionally advised companies to replace iPhones, Macs, and iPads till February twenty fifth in opposition to an Apple WebKit distant code execution bug exploited within the wild.
Sooner or later earlier, FCEB companies had been additionally requested to patch 15 different actively exploited flaws, with the Home windows SeriousSAM privileges escalation bug permitting attackers to execute arbitrary code with SYSTEM privileges tagged for patching by February twenty fourth.
[ad_2]
