The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> SonicWall SonicOS, ImageMagick\u00a0and Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.
Below are the descriptions for these vulnerabilities:<\/p>\n\n\n\n
CVE-2022-21445 vulnerability (CVSS score of 9.8) is a remote code execution issue in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). An unauthenticated attacker with network access via HTTP could exploit the flaw to compromise Oracle JDeveloper. Successful attacks of this vulnerability can result in the takeover of Oracle JDeveloper. The flaw affects 12.2.1.3.0 and 12.2.1.4.0 versions. According to the advisory, it is easily exploitable.\u00a0<\/p>\n\n\n\n
CVE-2020-14644 vulnerability (CVSS score of 9.8) is a remote code execution issue
The flaw affects versions 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0 and is easily exploitable.<\/p>\n\n\n\n
CVE-2019-1069 vulnerability (CVSS score of 7.8) is an elevation of privilege issue in the way the Task Scheduler Service validates certain file operations, aka ‘Task Scheduler Elevation of Privilege Vulnerability’. <\/p>\n\n\n\n
An attacker could exploit the flaw to gain elevated privileges on a victim system. To exploit the vulnerability, an attacker would require unprivileged code execution on a victim system.<\/p>\n\n\n\n
The flaw was disclosed by the researcher\u00a0SandboxEscaper<\/a>\u00a0in June, and Microsoft addressed<\/a> it in the same month with the release of Patch Tuesday security updates.<\/p>\n\n\n\n
At the time, Microsoft confirmed the issue was exploited in attacks in the wild.<\/p>\n\n\n\n
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n
CISA orders federal agencies to fix this vulnerability by\u00a0October 9, 2024.<\/p>\n\n\n\n
Pierluigi Paganini<\/strong><\/a>
Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/a><\/p>\n\n\n\n
(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking,\u00a0CISA<\/a>)<\/strong>