The Cybersecurity and Infrastructure Security Agency (CISA) added 41 vulnerabilities to its catalog of known exploited bugs this week.
The batch is one of the largest to be added to the list since the organization began compiling it back in November last year, with the additions including bugs relating to the likes of Microsoft, Apple, Google, Cisco, Adobe, Facebook, WhatsApp, Mozilla, Kaseya, Artifex, and QNAP.
The dates of these vulnerabilities range from 2016 to 2021, with the CISA giving federal agencies until June 13 and 14 to provide patches and “reduce their exposure to cyber attacks".
The organisation says it adds exploited vulnerabilities “when they become known”. subject to an executive review and when they satisfy three key thresholds: the vulnerability has an assigned Common Vulnerabilities and Exposures (CVE) ID, there is reliable evidence that it has been actively exploited in the wild, and when there is clear remediation action for the bug.
The oldest of the batch dates back to 2016 and concerns a Microsoft Internet Explorer Disclosure Vulnerability titled CVE-2016-0162, used to allow remote attackers to determine the existence of files via crafted JavaScript code.
The most recent listing is a Cisco IOS XR open port vulnerability (CVE-2022-20821), which was fixed last week. This bug is used to allow an unauthenticated, remote attacker to access the Redis instance that is running within the NOSi container.
Elsewhere, two Android Linux Kernel flaws were also added - CVE-2021-1048 and CVE-2021-0920 – which have been known to only be used in limited attacks against Android devices.
CISA also listed the Windows elevation of privileges vulnerability (CVE-2020-0638). Despite being disclosed back in 2020, the flaw was still being used by ransomware gang Conti as part of corporate attacks this year.
The list of vulnerabilities were added to the catalog in two parts, with CISA giving federal agencies until June 13th for the 21 added on Monday, and until June 14th for the 20 listed on Tuesday.
-
MSPs emerge as key security partners for mid-market enterprisesNews The MSP Customer Insight Report reveals 85% of mid-sized organizations now rely on MSPs for security support
-
EnGenius ECW516L reviewReviews The EAP516L is a feature-rich business Wi-Fi 7 access point with free cloud management and a fair performance for the price
-
The ransomware boom shows no signs of letting up – and these groups are causing the most chaosNews Thousands of ransomware cases have already been posted on the dark web this year
-
Everything we know about the Ingram Micro cyber attack so farNews A cyber attack on Ingram Micro severely disrupted operations and has been claimed by the SafePay ransomware group.
-
A prolific ransomware group says it’s shutting down and giving out free decryption keys to victims – but cyber experts warn it's not exactly a 'gesture of goodwill'News The Hunters International ransomware group is rebranding and switching tactics
-
Swiss government data published following supply chain attack – here’s what we know about the culpritsNews Radix, a non-profit organization in the health promotion sector, supplies a number of federal offices, whose data has apparently been accessed.
-
Ransomware victims are getting better at haggling with hackersNews While nearly half of companies paid a ransom to get their data back last year, victims are taking an increasingly hard line with hackers to strike fair deals.
-
LockBit data dump reveals a treasure trove of intel on the notorious hacker groupNews An analysis of May's SQL database dump shows how much LockBit was really making
-
‘I take pleasure in thinking I can rid society of at least some of them’: A cyber vigilante is dumping information on notorious ransomware criminals – and security experts say police will be keeping close tabsNews An anonymous whistleblower has released large amounts of data allegedly linked to the ransomware gangs
-
It's been a bad week for ransomware operators
News A host of ransomware strains have been neutralized, servers seized, and key players indicted
