<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Internet Explorer and Twilio Authy bugs to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/strong><\/a> the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog<\/a>:<\/gwmw><\/p>\n\n\n\n

\n
• CVE-2012-4792<\/a>\u00a0Microsoft Internet Explorer Use-After-Free Vulnerability<\/li>\n\n\n\n
• CVE-2024-39891<\/a>\u00a0Twilio Authy Information Disclosure Vulnerability<\/li>\n<\/ul>\n\n\n\n

  Below are the descriptions of the flaws added to the KEV catalog:<\/p>\n\n\n\n

  CVE-2012-4792<\/a> (CVSS score of 9.3) is a use-after-free issue in Microsoft Internet Explorer 6 through 8. Remote attackers can exploit the flaw to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object, and exploited in the wild in December 2012.<\/p>\n\n\n\n

  CVE-2024-39891<\/a>\u00a0(CVSS score of 5.3) is a Twilio Authy information disclosure vulnerability. In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain phone-number data, as exploited in the wild in June 2024. An endpoint was discovered that could receive phone numbers and return information indicating whether each number was registered with Authy. Importantly, while this endpoint confirmed the registration status, it did not compromise Authy accounts themselves.
  
  According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/p>\n\n\n\n

  Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

  CISA orders federal agencies to fix this vulnerability by\u00a0August 13, 2024.<\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0CISA<\/a>)<\/strong><\/p>\n\n\n\n

  <\/p>\n\n\n\n

  <\/gwmw><\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Internet Explorer and Twilio Authy bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the descriptions of the flaws added to the KEV catalog: CVE-2012-4792 (CVSS score of […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[8913,182,4112,9508,9506,10918,12584,687,841,1533],"class_list":["post-166126","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-cisa","tag-data-breach","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-known-exploited-vulnerabilities-catalog","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n