{"id":762291,"date":"2023-10-22T21:49:19","date_gmt":"2023-10-23T03:49:19","guid":{"rendered":"https:\/\/blogging-techies.com\/sw\/cisa-listade-17-nya-aktivt-utnyttjade-sarbarheter-rekommenderar-patchning\/"},"modified":"2023-10-22T21:49:19","modified_gmt":"2023-10-23T03:49:19","slug":"cisa-listade-17-nya-aktivt-utnyttjade-sarbarheter-rekommenderar-patchning","status":"publish","type":"post","link":"https:\/\/blogging-techies.com\/sw\/cisa-listade-17-nya-aktivt-utnyttjade-sarbarheter-rekommenderar-patchning\/","title":{"rendered":"CISA listade 17 nya aktivt utnyttjade s\u00e5rbarheter, rekommenderar patchning"},"content":{"rendered":"

US Cybersecurity and Infrastructure Security Agency (CISA) har lagt till 17 nya s\u00e5rbarheter till sin “Catalog of Known Exploited Vulnerabilities”-lista.<\/strong><\/p>\n

Dessa s\u00e5rbarheter utnyttjas aktivt i naturen, s\u00e5 byr\u00e5n vill att dess kontor under Federal Civil Executive Branch ska skydda dem genom att mildra dem genom patchar eller l\u00f6sningar. 10 av de 17 listade borde vara s\u00e4krade senast den f\u00f6rsta veckan i februari, sa CISA.<\/p>\n

<\/span>CISA-katalogen \u00f6ver k\u00e4nda exploaterade s\u00e5rbarheter<\/strong><\/span><\/h2>\n

Med j\u00e4mna mellanrum sl\u00e4pper U.S.C. Cybersecurity and Infrastructure Security Agency (CISA) en uppdatering ‘Katalog \u00f6ver k\u00e4nda exploaterade s\u00e5rbarheter<\/strong>‘, d\u00e4r den listar de s\u00e4kerhetsbrister som f\u00f6r n\u00e4rvarande utnyttjas aktivt. Och den h\u00e4r veckan har byr\u00e5n lagt till 17 nya s\u00e5rbarheter till listan.<\/strong><\/p>\n

Dessa, enligt CISA, kommer att till\u00e5ta hotakt\u00f6rer att utf\u00f6ra olika attacker, s\u00e5som fj\u00e4rrexekvering av kommandon, stj\u00e4la autentiseringsuppgifter och k\u00e4nslig information, f\u00e5 tillg\u00e5ng till n\u00e4tverk och ladda ner och exekvera skadlig programvara.. Eftersom dessa missbrukas i naturen vill CISA att dess Federal Civil Executive Branch (FCEB) byr\u00e5er ska agera p\u00e5 dem omedelbart.<\/strong><\/p>\n

10 av de totalt 17 nya s\u00e5rbarheter som lagts till \u00e4r nu till sin natur h\u00f6grisk. S\u00e5 CISA sa att dessa 10 anm\u00e4rkningsv\u00e4rda s\u00e5rbarheter beh\u00f6vde \u00e5tg\u00e4rdas senast den f\u00f6rsta veckan i februari. Totalt \u00e4r de 17 s\u00e5rbarheter som lagts till i det nya bindande operativa direktivet (BOD) 22-01;<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
CVE-nummer<\/strong><\/td>\nCVE-titel<\/strong><\/td>\n\u00c5tg\u00e4rd kr\u00e4vs F\u00f6rfallodatum<\/strong><\/td>\n<\/tr>\n
CVE-2021-32648<\/td>\nOktober CMS Felaktig autentisering<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-21315<\/td>\nSysteminformationsbibliotek f\u00f6r s\u00e5rbarhet f\u00f6r node.js Command Injection<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-21975<\/td>\nServer-Side Request Forgerency i vRealize Operations Manager API s\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-22991<\/td>\nBIG-IP Traffic Microkernel Buffer Overflow s\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-25296<\/td>\nNagios XI OS Command Injection s\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-25297<\/td>\nNagios XI OS Command Injection s\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-25298<\/td>\nNagios XI OS Command Injection s\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-33766<\/td>\nS\u00e5rbarhet i Microsoft Exchange Server Information Disclosure<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-40870<\/td>\nAviatrix Controller obegr\u00e4nsad filuppladdningss\u00e5rbarhet<\/td>\n2022-01-01<\/td>\n<\/tr>\n
CVE-2021-35247<\/td>\nSolarWinds Serv-U Felaktig indatavalidering s\u00e5rbarhet<\/td>\n2022-02-04<\/td>\n<\/tr>\n
CVE-2020-11978<\/td>\nApache Airflow Command Injection s\u00e5rbarhet<\/td>\n2022-07-18<\/td>\n<\/tr>\n
CVE-2020-13671<\/td>\nDrupal Core obegr\u00e4nsad filuppladdningss\u00e5rbarhet<\/td>\n2022-07-18<\/td>\n<\/tr>\n
CVE-2020-13927<\/td>\nApache Airflow Experimental API Authentication Bypass s\u00e5rbarhet<\/td>\n2022-07-18<\/td>\n<\/tr>\n
CVE-2020-14864<\/td>\nOracle Corporate Business Intelligence Enterprise Edition-s\u00e5rbarhet<\/td>\n2022-07-18<\/td>\n<\/tr>\n
CVE-2006-1547<\/td>\nApache Struts Action Form Denial of Service S\u00e5rbarhet 1<\/td>\n2022-07-21<\/td>\n<\/tr>\n
CVE-2012-0391<\/td>\nApache Struts 2 Felaktig indatavalidering s\u00e5rbarhet<\/td>\n2022-07-21<\/td>\n<\/tr>\n
CVE-2018-8453<\/td>\nS\u00e5rbarhet i Microsoft Windows Win32k Privilege Escalation<\/td>\n2022-07-21<\/td>\n<\/tr>\n<\/table>\n

Detta avsl\u00f6jande \u00e4r avsett att minska den betydande risken f\u00f6r att k\u00e4nda s\u00e5rbarheter utnyttjas, s\u00e4ger CISA. Den uppdaterade listan har nu totalt cirka 341 s\u00e5rbarheter.<\/p>\n

\n
\n

Table of Contents<\/p>\nToggle<\/span><\/path><\/svg><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n