CISA Tells Organizations to Patch CVEs Dating Back to 2014
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-1776 | Use-After-Free Memory Corruption RCE in Microsoft Internet Explorer | — | 83% | KEV | — KEV |
| CVE-2014-6271 | Arbitrary Code Execution in GNU Bash (Shellshock) | — | 100% | KEV | — KEV |
| CVE-2014-7169 | Arbitrary Code Execution in GNU Bash via Environment Variables (Shellshock Follow-Up) | — | 100% | KEV | — KEV |
| CVE-2021-20038 | Unauthenticated Stack Buffer Overflow in SonicWall SMA 100 Appliances | 9.8 | 100% | KEVRansomwarePoC ×2 | KEV |
| CVE-2022-22587 | Memory Corruption in Apple iOS, iPadOS, and macOS Allows Kernel-Privilege Code Execution | 9.8 | 12% | KEV | KEV |
From the original article
2 min read at infosecurity-magazine.com
The US government has added eight more vulnerabilities to its growing list of CVEs that must be patched by federal agencies, including some that first appeared eight years ago. The Cybersecurity and Infrastructure Security Agency (CISA) first launched its Known Exploited Vulnerabilities Catalog in November 2021 as part of a government effort to enhance cyber-resilience.
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.