Frame-14

Privacy Ninja

        • DATA PROTECTION

        • Email Spoofing Prevention
        • Check if your organization email is vulnerable to hackers and put a stop to it. Receive your free test today!
        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • AntiHACK Phone
        • Boost your smartphone’s security with enterprise-level encryption, designed by digital forensics and counterintelligence experts, guaranteeing absolute privacy for you and up to 31 others, plus a guest user, through exclusive access.

        • CYBERSECURITY

        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$3,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Secure your digital frontiers with our API penetration testing service, meticulously designed to identify and fortify vulnerabilities, ensuring robust protection against cyber threats.

        • Network Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Mobile Penetration Testing
        • Strengthen your network’s defenses with our comprehensive penetration testing service, tailored to uncover and seal security gaps, safeguarding your infrastructure from cyber attacks.

        • Web Penetration Testing
        • Fortify your web presence with our specialized web penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats.

        • RAPID DIGITALISATION

        • OTHERS

CISA Tells Federal Agencies to Patch Actively Exploited Chrome, Magento Bugs

CISA Tells Federal Agencies to Patch Actively Exploited Chrome, Magento Bugs

The US Cybersecurity and Infrastructure Security Agency (CISA) has added nine new flaws to its collection of actively exploited vulnerabilities, including two recently patched zero-days impacting Google Chrome and Adobe Commerce/Magento Open Source.

The Chrome vulnerability (CVE-2022-0609) is a high severity use after free bug that can let attackers execute arbitrary code or escape the browser’s security sandbox on computers running unpatched Chrome versions addressed in Chrome 98.0.4758.102.

Adobe released an emergency update to fix a critical flaw (CVE-2022-24086) exploited in the wild “in very limited attacks” to gain remote code execution using exploits targeting Adobe Commerce and Magento Open Source versions 2.4.3-p1/2.3.7-p2.

Also Read: 10 Best, Secured And Trusted Disposal Contractor In Singapore

eCommerce security company Sansec warned that the Magento flaw is similar to the 2015 critical bug Magento Shoplift which enabled threat actors to take over vulnerable Magento sites.

CISA said that all Federal Civilian Executive Branch Agencies (FCEB) agencies must deploy patches for these two security vulnerabilities until March 1st, 2022.

The complete list of nine flaws added today to CISA’s Known Exploited Vulnerabilities Catalog includes a mix of old and new bugs, ranging from 2013 to 2022, as shown in the table below.

CVE NumberCVE TitlePatch Deadline
CVE-2022-24086Adobe Commerce and Magento Open Source Improper Input Validation03/01/22
CVE-2022-0609Google Chrome Use-After-Free03/01/22
CVE-2019-0752Microsoft Internet Explorer Type Confusion08/15/22
CVE-2018-8174Microsoft Windows VBScript Engine Out-of-Bounds Write08/15/22
CVE-2018-20250WinRAR Absolute Path Traversal08/15/22
CVE-2018-15982Adobe Flash Player Use-After-Free08/15/22
CVE-2017-9841PHPUnit Command Injection08/15/22
CVE-2014-1761Microsoft Word Memory Corruption08/15/22
CVE-2013-3906Microsoft Graphics Component Memory Corruption08/15/22

Federal agencies are required to patch their systems against these actively exploited vulnerabilities, according to a binding operational directive (BOD 22-01) issued by CISA in November 2021.

“These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise,” the cybersecurity agency said.

Also Read: 10 Tips For Drafting Key Terms In A Service Agreement

“Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice.”

Last week, the US cybersecurity agency also told agencies to update iPhones, Macs, and iPads until February 25th against an Apple WebKit remote code execution bug exploited in the wild.

One day earlier, FCEB agencies were also asked to patch 15 other actively exploited flaws, with the Windows SeriousSAM privileges escalation bug allowing attackers to execute arbitrary code with SYSTEM privileges tagged for patching by February 24th.

0 Comments

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Hello!

Click one of our contacts below to chat on WhatsApp

× Chat with us