The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new flaws to its Known Exploited Vulnerabilities Catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including a high-severity security flaw (CVE-2021-38406 CVSS score: 7.8) impacting Delta Electronics industrial automation software.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
According to the US agency, Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation). An attacker can trigger the flaw to cause an out-of-bounds write and achieve code execution.
It is important to highlight that there are no security patches to fix this issue and that the impacted product is end-of-life.
CISA also added to the catalog a Sanbox Bypass Vulnerability, tracked as CVE-2021-31010 (CVSS score: 7.5), in Apple iOS, macOS, and watchOS.
“In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.” reads the advisory.
The other vulnerabilities added to the catalog are:
CVE-2022-26352 – dotCMS Unrestricted Upload of File VulnerabilityCVE-2022-24706 – Apache CouchDB Insecure Default Initialization of Resource VulnerabilityCVE-2022-24112 – Apache APISIX Authentication Bypass VulnerabilityCVE-2022-22963 – VMware Tanzu Spring Cloud Function Remote Code Execution VulnerabilityCVE-2022-2294 – WebRTC Heap Buffer Overflow VulnerabilityCVE-2021-39226 – Grafana Authentication Bypass VulnerabilityCVE-2020-36193 – PEAR Archive_Tar Improper Link Resolution VulnerabilityCVE-2020-28949 – PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityCISA orders federal agencies to fix these vulnerabilities by September 15, 2022.
Follow me on Twitter: @securityaffairs and Facebook
(SecurityAffairs – hacking, Known Exploited Vulnerabilities Catalog)
The post CISA adds 10 new flaws to its Known Exploited Vulnerabilities Catalog appeared first on Security Affairs.