Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

CISA Warns Orgs to Patch Actively Exploited Windows LPE Bug

CISA Warns Orgs to Patch Actively Exploited Windows LPE Bug

The Cybersecurity and Infrastructure Security Agency (CISA) has added ten new security bugs to its list of actively exploited vulnerabilities, including a high severity local privilege escalation bug in the Windows Common Log File System Driver.

This high severity security flaw (tracked as CVE-2022-24521) was reported by CrowdStrike and the US National Security Agency (NSA), and it got patched by Microsoft during this month’s Patch Tuesday.

According to a binding operational directive (BOD 22-01) issued in November, all Federal Civilian Executive Branch Agencies (FCEB) agencies must secure their systems against this security flaw after being added to CISA’s catalog of Known Exploited Vulnerabilities (KEV).

Also Read: What is a data protection officer? Through the lens of a Master DPO

CISA has given them three weeks, until May 2nd, to patch the CVE-2022-24521 vulnerability flaw and block ongoing exploitation attempts.

Although the BOD 22-01 directive only applies to US federal agencies, CISA also strongly urges all US organizations to patch this actively exploited security bug to block attempts to escalate privileges on their Windows systems.

The US cybersecurity agency added nine more vulnerabilities to its catalog today, abused in ongoing attacks.

CVEVulnerability NameDue Date
CVE-2022-24521Microsoft Windows CLFS Driver Privilege Escalation2022-05-04
CVE-2018-7602Drupal Core Remote Code Execution Vulnerability2022-05-04
CVE-2018-20753Kaseya VSA Remote Code Execution Vulnerability2022-05-04
CVE-2015-5123Adobe Flash Player Use-After-Free Vulnerability2022-05-04
CVE-2015-5122Adobe Flash Player Use-After-Free Vulnerability2022-05-04
CVE-2015-3113Adobe Flash Player Heap-Based Buffer Overflow2022-05-04
CVE-2015-2502Microsoft Internet Explorer Memory Corruption2022-05-04
CVE-2015-0313Adobe Flash Player Use-After-Free Vulnerability2022-05-04
CVE-2015-0311Adobe Flash Player Remote Code Execution Vulnerability2022-05-04
CVE-2014-9163Adobe Flash Player Stack-Based Buffer Overflow2022-05-04

Today, CISA also encouraged admins to install security updates that address a critical pre-auth remote code execution vulnerability (with a 9.8/10 severity rating) in the Microsoft Remote Procedure Call (RPC) Runtime Library, also patched this week as part of the April 2022 Patch Tuesday.

Hundreds of actively exploited bugs added to CISA’s catalog

On Monday, CISA also ordered federal civilian agencies to patch an actively exploited security bug (CVE-2022-23176) in WatchGuard Firebox and XTM firewall appliances.

Also Read: Social engineering attacks: 4 Ways businesses and individuals can protect themselves

The Sandworm Russian-backed hacking group previously abused this bug to build a botnet dubbed Cyclops Blink out of compromised WatchGuard Small Office/Home Office (SOHO) network devices.

On Wednesday, the US government disrupted the Cyclops Blink botnet by removing the malware from command-and-control servers before being weaponized and used in attacks.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise,” the US cybersecurity agency explains.

After issuing the BOD 22-01 binding directive, CISA has added hundreds of security vulnerabilities to its list of actively exploited flaws, ordering US federal agencies to patch them as soon as possible to block security breaches.



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us