{"id":8345,"date":"2022-07-22T10:27:37","date_gmt":"2022-07-22T10:27:37","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8345"},"modified":"2023-03-07T16:14:06","modified_gmt":"2023-03-07T23:14:06","slug":"dhs-cisa-kevs-weekly-edition-11-patch-before-you-hit-the-deadline","status":"publish","type":"patch_watch","link":"https:\/\/webdev.securin.xyz\/patch_watch\/dhs-cisa-kevs-weekly-edition-11-patch-before-you-hit-the-deadline\/","title":{"rendered":"DHS CISA KEVs Weekly Edition 11: Patch Before you Hit the Deadline"},"content":{"rendered":"<p dir=\"ltr\">Microsoft released patches for 84 vulnerabilities on Patch Tuesday, July 12, 2022. One of the CVEs was a critical zero-day vulnerability affecting the Windows CSRSS devices. CISA added this vulnerability to the KEV list last week, bringing the total KEVs to 788. This week, CISA has recommended that patches should be applied for 15 vulnerabilities by July 21, 2022. Let us see what they are:<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 750px; height: 410px;\" src=\"\/wp-content\/uploads\/2022\/10\/dhs-cisa-kevs-3.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">How Far Back Do They Go?<\/h2>\n<p dir=\"ltr\">Of the 15 KEVs, the oldest vulnerability, an Apache Struts 1 ActionForm denial-of-service vulnerability, dates back to 2006.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 288px;\" src=\"\/wp-content\/uploads\/2022\/10\/year-wise-breakdown-3.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Which Vendors Are Affected?<\/h2>\n<p dir=\"ltr\">Several prominent vendor products are affected by the vulnerabilities that need to be patched by July 21, 2022.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 393px;\" src=\"\/wp-content\/uploads\/2022\/10\/vendors-affected-5.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Severity Scores<\/h2>\n<p dir=\"ltr\">Patching these vulnerabilities is of high priority, as most of them rank high on the CVSS.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 507px;\" src=\"\/wp-content\/uploads\/2022\/10\/severity-scores-4.png\" alt=\"\" \/><\/p>\n<h2 dir=\"ltr\">Software Weaknesses<\/h2>\n<p dir=\"ltr\">The following CWEs have caused the 15 vulnerabilities that need to be patched this week.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter\" style=\"width: 550px; height: 499px;\" src=\"\/wp-content\/uploads\/2022\/10\/software-weaknesses-3.png\" alt=\"\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrkvOJe1ZDBTeSUO?backgroundColor=blue&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p dir=\"ltr\" style=\"text-align: left;\">Table: DHS CISA KEVs<\/p>\n<p dir=\"ltr\">Most of these vulnerabilities are weaponized, meaning they have been actively used in attacks. CVE-2018-8453 has associations with more than five critical ransomware. Hence, all federal agencies and private organizations should immediately patch this CVE and all the above-listed CVEs, as they are highly susceptible to attacks.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft released patches for 84 vulnerabilities on Patch Tuesday, July 12, 2022. One of the CVEs was a critical zero-day vulnerability affecting the Windows CSRSS devices. CISA added this vulnerability to the KEV list last week, bringing the total KEVs to 788. This week, CISA has recommended that patches should be applied for 15 vulnerabilities [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14436,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[287,288],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch\/8345"}],"collection":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media\/14436"}],"wp:attachment":[{"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/media?parent=8345"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/webdev.securin.xyz\/wp-json\/wp\/v2\/patch_category?post=8345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}