CISA adds 10 new flaws to its Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new flaws to its Known Exploited Vulnerabilities Catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added 10 new vulnerabilities to its Known Exploited Vulnerabilities Catalog, including a high-severity security flaw (CVE-2021-38406 CVSS score: 7.8) impacting Delta Electronics industrial automation software.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

According to the US agency, Delta Electronics DOPSoft 2 lacks proper validation of user-supplied data when parsing specific project files (improper input validation). An attacker can trigger the flaw to cause an out-of-bounds write and achieve code execution.

It is important to highlight that there are no security patches to fix this issue and that the impacted product is end-of-life.

CISA also added to the catalog a Sanbox Bypass Vulnerability, tracked as CVE-2021-31010 (CVSS score: 7.5), in Apple iOS, macOS, and watchOS.

“In affected versions of Apple iOS, macOS, and watchOS, a sandboxed process may be able to circumvent sandbox restrictions.” reads the advisory.

The other vulnerabilities added to the catalog are:

• CVE-2022-26352 – dotCMS Unrestricted Upload of File Vulnerability
• CVE-2022-24706 – Apache CouchDB Insecure Default Initialization of Resource Vulnerability
• CVE-2022-24112 – Apache APISIX Authentication Bypass Vulnerability
• CVE-2022-22963 – VMware Tanzu Spring Cloud Function Remote Code Execution Vulnerability
• CVE-2022-2294 – WebRTC Heap Buffer Overflow Vulnerability
• CVE-2021-39226 – Grafana Authentication Bypass Vulnerability
• CVE-2020-36193 – PEAR Archive_Tar Improper Link Resolution Vulnerability
• CVE-2020-28949 – PEAR Archive_Tar Deserialization of Untrusted Data Vulnerability

CISA orders federal agencies to fix these vulnerabilities by September 15, 2022.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Known Exploited Vulnerabilities Catalog)

[adrotate banner=”5″]

[adrotate banner=”13″]