[ad_1]
The US Cybersecurity and Infrastructure Safety Company (CISA) has added 9 new flaws to its assortment of actively exploited vulnerabilities, together with two not too long ago patched zero-days impacting Google Chrome and Adobe Commerce/Magento Open Supply.
The Chrome vulnerability (CVE-2022-0609) is a excessive severity use after free bug that can let attackers execute arbitrary code or escape the browser’s safety sandbox on computer systems working unpatched Chrome variations addressed in Chrome 98.0.4758.102.
Adobe launched an emergency replace to repair a vital flaw (CVE-2022-24086) exploited within the wild “in very restricted assaults” to achieve distant code execution utilizing exploits focusing on Adobe Commerce and Magento Open Supply variations 2.4.3-p1/2.3.7-p2.
eCommerce safety firm Sansec warned that the Magento flaw is just like the 2015 vital bug Magento Shoplift which enabled menace actors to take over weak Magento websites.
CISA mentioned that each one Federal Civilian Government Department Companies (FCEB) companies should deploy patches for these two safety vulnerabilities till March 1st, 2022.
The entire record of 9 flaws added right now to CISA’s Identified Exploited Vulnerabilities Catalog consists of a mixture of outdated and new bugs, starting from 2013 to 2022, as proven within the desk beneath.
| CVE Quantity | CVE Title | Patch Deadline |
| CVE-2022-24086 | Adobe Commerce and Magento Open Supply Improper Enter Validation | 03/01/22 |
| CVE-2022-0609 | Google Chrome Use-After-Free | 03/01/22 |
| CVE-2019-0752 | Microsoft Web Explorer Kind Confusion | 08/15/22 |
| CVE-2018-8174 | Microsoft Home windows VBScript Engine Out-of-Bounds Write | 08/15/22 |
| CVE-2018-20250 | WinRAR Absolute Path Traversal | 08/15/22 |
| CVE-2018-15982 | Adobe Flash Participant Use-After-Free | 08/15/22 |
| CVE-2017-9841 | PHPUnit Command Injection | 08/15/22 |
| CVE-2014-1761 | Microsoft Phrase Reminiscence Corruption | 08/15/22 |
| CVE-2013-3906 | Microsoft Graphics Element Reminiscence Corruption | 08/15/22 |
Federal companies are required to patch their programs towards these actively exploited vulnerabilities, in keeping with a binding operational directive (BOD 22-01) issued by CISA in November 2021.
“Some of these vulnerabilities are a frequent assault vector for malicious cyber actors of every kind and pose vital danger to the federal enterprise,” the cybersecurity company mentioned.
“Though BOD 22-01 solely applies to FCEB companies, CISA strongly urges all organizations to scale back their publicity to cyberattacks by prioritizing well timed remediation of Catalog vulnerabilities as a part of their vulnerability administration follow.”
Final week, the US cybersecurity company additionally advised companies to replace iPhones, Macs, and iPads till February twenty fifth towards an Apple WebKit distant code execution bug exploited within the wild.
In the future earlier, FCEB companies have been additionally requested to patch 15 different actively exploited flaws, with the Home windows SeriousSAM privileges escalation bug permitting attackers to execute arbitrary code with SYSTEM privileges tagged for patching by February twenty fourth.
[ad_2]
