<\/div>\n

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog.<\/h2>\n\n\n\n

The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> an\u00a0Android Kernel Remote Code Execution flaw (CVE-2024-36971<\/a>) and an Apache OFBiz Path Traversal issue (CVE-2024-32113<\/a>)\u00a0to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n

Below are the descriptions of the two flaws:<\/p>\n\n\n\n

\n
• CVE-2024-36971<\/a> is a remote code execution vulnerability impacting the Android kernel. The vulnerability was\u00a0discovered<\/a>\u00a0by Clement Lecigne of Google\u2019s Threat Analysis Group (TAG). The TAG team investigates attacks carried out by nation-state actors and\u00a0commercial spyware vendors<\/a>. The IT giant is aware that the vulnerability has been actively exploited in the wild. The company did not share details of the attacks exploiting this vulnerability.<\/li>\n\n\n\n
• CVE-2024-32113<\/a> is a path traversal issue in the Apache OFBiz. The exploitation of this vulnerability could lead to remote command execution. Researchers from SANS recently observed a surge in the attacks targeting CVE-2024-32113.<\/li>\n<\/ul>\n\n\n\n

  According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.<\/gwmw><\/p>\n\n\n\n

  Experts recommend also private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n

  CISA orders federal agencies to fix this vulnerability by\u00a0August 28, 2024.<\/p>\n\n\n\n

  Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n

  Pierluigi\u00a0Paganini<\/strong><\/a><\/gwmw><\/p>\n\n\n\n

  (<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, Known Exploited Vulnerabilities Catalog<\/a>)<\/strong><\/gwmw><\/gwmw><\/gwmw><\/p>\n\n\n\n

  <\/gwmw><\/p>\n","protected":false},"excerpt":{"rendered":"

  U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Apache OFBiz and Android kernel bugs to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added an\u00a0Android Kernel Remote Code Execution flaw (CVE-2024-36971) and an Apache OFBiz Path Traversal issue (CVE-2024-32113)\u00a0to its Known Exploited Vulnerabilities (KEV) catalog. Below are the descriptions of the […]<\/p>\n","protected":false},"author":1,"featured_media":106349,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3323,5,55],"tags":[8913,4112,9508,9506,10918,12584,687,841,1533],"class_list":["post-166782","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news","category-hacking","category-security","tag-cisa","tag-hacking","tag-hacking-news","tag-information-security-news","tag-it-information-security","tag-known-exploited-vulnerabilities-catalog","tag-pierluigi-paganini","tag-security-affairs","tag-security-news"],"yoast_head":"\n