A Quick Look at Some Old and New Security Vulnerabilities Which Need to be Patched Before 2020
Nearly 45 new vulnerabilities get discovered on average every day. Since 2016, Researchers has observed an increase of 130% in the total number of disclosed vulnerabilities.
Out of these, 60% of vulnerabilities are rated ‘Critical’ or ‘High’ severity and 45% impact Microsoft products. Here are the top 20 must-needed patches for the vulnerabilities recorded since 2016.
CVE-2019-0708 - Older versions of Microsoft Windows
Termed as ‘BlueKeep’, the vulnerability affects the Remote Desktop Services of Windows systems. An attacker could successfully exploit the vulnerability to execute arbitrary code on the target system.
CVE-2019-2725 - Oracle WebLogic Server
A deserialization vulnerability, a flaw could be exploited to cause remote code execution without authentication. It affects the server versions 10.3.6.0 and 12.1.3.0.
CVE-2018-12130 - Intel x86 microprocessors
A subclass of speculative execution side-channel vulnerabilities - also known as Microarchitectural Fill Buffer Data Sampling - can allow attackers to read privileged data across trust boundaries. Microsoft has released software updates to mitigate the vulnerability and three others.
CVE-2018-0802 - Microsoft Office software
Classified as remote code execution vulnerability, the flaw can allow attackers to run arbitrary code in the context of the current user. This can enable attackers to install programs, view, change or delete data.
CVE-2018-10561 - DASAN Networks
In July, it was reported that a hacker built an IoT botnet of 18,000 Huawei-based devices in a day to exploit the flaw.
CVE-2018-7600 - Drupal
The flaw could be abused to allow attackers to execute arbitrary code. It affects Drupal before 7.58, 8.3.9,8.4.6 and 8.5.1.
CVE-2018-20250 - WinRAR
The vulnerability was wildly exploited in a targeted attack against organizations in the satellite and communications industry. Attackers can take advantage of the vulnerability to run multiple code execution techniques.
CVE-2018-4878 - Adobe Flash Player
South Korea’s CERT had issued an alert regarding the exploitation of the vulnerability to distribute malicious code hidden in MS documents.
CVE-2017-0143 - Microsoft SMB 1.0
An attacker can exploit the vulnerability by sending a specially crafted packet to a target SMBv1 server. The flaw could allow attackers to execute code on the targeted server.
CVE-2017-8570 - Microsoft Office software
The vulnerability was exploited by attackers to download high-profile malware such as Loki and Nanocore. The vulnerability was patched in July 2017.
CVE-2017-5715 - Spectre and Meltdown vulnerabilities
Known as microprocessor side-channel attacks, the flaw affects ARM and Intel processors. The mitigation guidance was released in April 2018.
CVE-2017-5638 - Apache Struts
The vulnerability is linked to the infamous Equifax data breach. The patch was made available in March 2017.
CVE-2017-11882 - Microsoft Office software
Microsoft had warned the wide exploitation of the vulnerability in a spam campaign observed in June 2019. Dubbed Memory corruption vulnerability, an attacker can abuse the flaw using a specially crafted file sent over an email.
CVE-2017-8759 - Microsoft.net Framework
In January 2018, attackers exploited this flaw to spread Zyklon HTTP malware. The flaw was patched in September 2017.
CVE-2014-8361 - D-Link, Realtek
A new variant of the Mirai botnet included an exploit for this flaw among its 13 exploits. The flaw was patched in May 2015.
CVE-2012-0158 - Microsoft Common Controls
A critical remote code execution vulnerability could allow remote code execution if a user visits a website containing specially crafted content. The security update - released in April 2010 - addresses the vulnerability by disabling the vulnerable version of the Windows common controls and replacing it with a new version that does not contain the vulnerability.