CISA is known for publishing various reports and remediations for cyberattacks. They release a list of many known exploited vulnerabilities which are exploited by hackers frequently. They have added a list of 15 new exploited vulnerabilities to their list.
The recent list contains almost all of the recent Windows Privilege Escalation vulnerabilities.
| CVE ID | Vulnerability Name | Due Date |
| CVE-2020-5135 | SonicWall SonicOS Buffer Overflow Vulnerability | 4/5/2022 |
| CVE-2019-1405 | Microsoft Windows UPnP Service Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1322 | Microsoft Windows Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1315 | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1253 | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1129 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1069 | Microsoft Task Scheduler Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-1064 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-0841 | Microsoft Windows AppXSVC Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2019-0543 | Microsoft Windows Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2018-8120 | Microsoft Win32k Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2017-0101 | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2016-3309 | Microsoft Windows Kernel Privilege Escalation Vulnerability | 4/5/2022 |
| CVE-2015-2546 | Microsoft Win32k Memory Corruption Vulnerability | 4/5/2022 |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability | 4/5/2022 |
The list was based on the Binding Operational Directive (BOD) 22-01 which states as “Reducing the Significant Risk of Known Exploited Vulnerabilities“. This directive was established to list the exploited vulnerabilities which has potential risk to Federal agencies and network. The directive importantly denoted that FCEB agencies must mitigate and remediate the list of identified vulnerabilities before the due date given.
Although the directive mentions FCEB agencies specifically, CISA instructs all organizations to use the list of known vulnerabilities and reduce the risk of cyberattacks.
CISA also mentioned that they will continue to update and address the known exploited vulnerabilities and will add them to the catalog in case of the specified criteria were met.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.
Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify a…
Researchers have identified a rise in malicious activity on the VSCode Marketplace, highlighting the vulnerability…
TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email containing…
BADBOX is a cybercriminal operation infecting Android devices like TV boxes and smartphones with malware…
Europol has published a groundbreaking report titled "Leveraging Legitimacy: How the EU’s Most Threatening Criminal Networks…
The Cybersecurity and Infrastructure Security Agency (CISA) has unveiled a proposed update to the National…