The Cybersecurity and Infrastructure Security Agency (CISA) added 41 vulnerabilities to its catalog of known exploited bugs this week.
The batch is one of the largest to be added to the list since the organization began compiling it back in November last year, with the additions including bugs relating to the likes of Microsoft, Apple, Google, Cisco, Adobe, Facebook, WhatsApp, Mozilla, Kaseya, Artifex, and QNAP.
The dates of these vulnerabilities range from 2016 to 2021, with the CISA giving federal agencies until June 13 and 14 to provide patches and “reduce their exposure to cyber attacks".
The organisation says it adds exploited vulnerabilities “when they become known”. subject to an executive review and when they satisfy three key thresholds: the vulnerability has an assigned Common Vulnerabilities and Exposures (CVE) ID, there is reliable evidence that it has been actively exploited in the wild, and when there is clear remediation action for the bug.
The oldest of the batch dates back to 2016 and concerns a Microsoft Internet Explorer Disclosure Vulnerability titled CVE-2016-0162, used to allow remote attackers to determine the existence of files via crafted JavaScript code.
The most recent listing is a Cisco IOS XR open port vulnerability (CVE-2022-20821), which was fixed last week. This bug is used to allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container.
Elsewhere, two Android Linux Kernel flaws were also added - CVE-2021-1048 and CVE-2021-0920 – which have been known to only be used in limited attacks against Android devices.
CISA also listed the Windows elevation of privileges vulnerability (CVE-2020-0638). Despite being disclosed back in 2020, the flaw was still being used by ransomware gang Conti as part of corporate attacks this year.
The list of vulnerabilities were added to the catalog in two parts, with CISA giving federal agencies until June 13th for the 21 added on Monday, and until June 14th for the 20 listed on Tuesday.
-
Trump's AI executive order could leave US in a 'regulatory vacuum'News Citing a "patchwork of 50 different regulatory regimes" and "ideological bias", President Trump wants rules to be set at a federal level
-
TPUs: Google's home advantageITPro Podcast How does TPU v7 stack up against Nvidia's latest chips – and can Google scale AI using only its own supply?
-
15-year-old revealed as key player in Scattered LAPSUS$ HuntersNews 'Rey' says he's trying to leave Scattered LAPSUS$ Hunters and is prepared to cooperate with law enforcement
-
The Scattered Lapsus$ Hunters group is targeting Zendesk customers – here’s what you need to knowNews The group appears to be infecting support and help-desk personnel with remote access trojans and other forms of malware
-
Impact of Asahi cyber attack laid bare as company confirms 1.5 million customers exposedNews No ransom has been paid, said president and group CEO Atsushi Katsuki, and the company is restoring its systems
-
The US, UK, and Australia just imposed sanctions on a Russian cyber crime group – 'we are exposing their dark networks and going after those responsible'News Media Land offers 'bulletproof' hosting services used for ransomware and DDoS attacks around the world
-
A notorious ransomware group is spreading fake Microsoft Teams ads to snare victimsNews The Rhysida ransomware group is leveraging Trusted Signing from Microsoft to lend plausibility to its activities
-
Volkswagen confirms security ‘incident’ amid ransomware breach claimsNews Volkswagen has confirmed a security "incident" has occurred, but insists no IT systems have been compromised.
-
The number of ransomware groups rockets as new, smaller players emergeNews The good news is that the number of victims remains steady
-
Teens arrested over nursery chain Kido hacknews The ransom attack caused widespread shock when the hackers published children's personal data
