CISA adds 3 new bugs to Known Exploited Vulnerabilities Catalog
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-42013 | Path Traversal and RCE in Apache HTTP Server (follow-up to CVE-2021-41773) | 9.8 | 100% | KEVRansomwarePoC ×6 | KEV |
| CVE-2022-28810 | Authenticated Command Injection RCE in ManageEngine ADSelfService Plus | 6.8 | 71% | KEVPoC ×3 | KEV |
| CVE-2022-33891 | Command Injection in Apache Spark UI via ACL Impersonation (CVE-2022-33891) | 8.8 | 93% | KEVPoC | KEV |
| CVE-2022-35914 | Unauthenticated PHP Code Injection RCE in GLPI via bundled htmlawed (through 10.0.2) | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
1 min read at securityaffairs.com
US CISA added actively exploited flaws in Teclib GLPI, Apache Spark, and Zoho ManageEngine ADSelfService Plus to its Known Exploited Vulnerabilities Catalog. US CISA added the following actively exploited flaws to its Known Exploited Vulnerabilities Catalog : CVE-2022-35914 (CVSS score: 9. 8) – Teclib GLPI Remote Code Execution Vulnerability
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.