Exploit / PoCcriticalExploited in the wild

U.S. Cybersecurity Agency CISA Adds Three New Vulnerabilities in KEV Catalog

The Hacker Newsby @TheHackersNewsFeb 22, 2023 · 12:38 UTC (Feb 22, 2023)1 min read1

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-47986 CVE-2022-41223 CVE-2022-40765 CVE-2023-0669 CVE-2022-26377 CVE-2022-31813

Tags: cve-2022-47986 cve-2022-41223 cve-2022-40765 cve-2023-0669 cve-2022-26377 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-31813 +1 related CVE CVE-2022-26377	Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism	9.8 group max	4%		Jun 9, 2022
CVE-2022-41223 +1 related CVE CVE-2022-40765	Authenticated Code Injection in Mitel MiVoice Connect Director (through 19.3)	6.8	11%	KEVRansomware	Nov 22, 2022 KEV Feb 21, 2023
CVE-2022-47986	YAML Deserialization RCE in IBM Aspera Faspex	9.8	100%	KEVRansomware	Feb 17, 2023 KEV Feb 21, 2023
CVE-2023-0669	Pre-Authentication Deserialization RCE in Fortra GoAnywhere MFT	7.2	100%	KEVRansomwarePoC ×3	Feb 6, 2023 KEV Feb 10, 2023

From the original article

1 min read at thehackernews.com

 Ravie Lakshmanan  Feb 22, 2023 Cyber Risk / Patch Management The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.