National Cyber Awareness System

Cisco Releases Security Advisory for IP Phone 7800 and 8800 Series CISA Releases Phishing Infographic CISA Releases Three Industrial Control Advisories CISA Adds One Known Exploited Vulnerability to Catalog

Ubuntu Security Notices

USN-5770-1: GCC vulnerability USN-5769-1: protobuf vulnerabilities USN-5767-2: Python vulnerability USN-5767-1: Python vulnerabilities USN-5768-1: GNU C Library vulnerabilities USN-5766-1: Heimdal vulnerability USN-5765-1: PostgreSQL vulnerability USN-5763-1: NumPy vulnerabilities USN-5761-2: ca-certificates update USN-5764-1: U-Boot vulnerabilities USN-5762-1: GNU binutils vulnerability USN-5761-1: ca-certificates update USN-5760-2: libxml2 vulnerabilities USN-5760-1: libxml2 vulnerabilities USN-5759-1: LibBPF vulnerabilities

Red Hat Security Advisory

(RHSA-2022:8889) Moderate: Openshift Logging 5.3.14 bug fix release and security update (RHSA-2022:8902) Moderate: Red Hat Camel for Spring Boot 3.18.3 release and security update (RHSA-2022:8841) Important: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update (RHSA-2022:8840) Moderate: Red Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update (RHSA-2022:8900) Important: grub2 security update (RHSA-2022:8897) Important: Red Hat OpenStack Platform 13.0 (instack-undercloud) security update (RHSA-2022:8896) Moderate: Red Hat OpenStack Platform 13.0 (python-virtualbmc) security update (RHSA-2022:8781) Moderate: Logging Subsystem 5.5.5 - Red Hat OpenShift security update (RHSA-2022:8860) Moderate: Red Hat OpenStack Platform 16.1.9 (protobuf) security update (RHSA-2022:8872) Important: Red Hat OpenStack Platform 16.1.9 (python-django20) security update (RHSA-2022:8864) Moderate: Red Hat OpenStack Platform 16.1.9 (python-ujson) security update (RHSA-2022:8873) Moderate: Red Hat OpenStack Platform 16.1.9 (python-oslo-utils) security update (RHSA-2022:8868) Moderate: Red Hat OpenStack Platform 16.1.9 (python-scciclient) security update (RHSA-2022:8867) Low: Red Hat OpenStack Platform 16.1.9 (rabbitmq-server) security update (RHSA-2022:8861) Moderate: Red Hat OpenStack Platform 16.1.9 (numpy) security update (RHSA-2022:8857) Moderate: Red Hat OpenStack Platform 16.2.4 (erlang) security update (RHSA-2022:8853) Moderate: Red Hat OpenStack Platform 16.2.4 (python-django20) security update (RHSA-2022:8856) Low: Red Hat OpenStack Platform 16.2.4 (python-django-horizon) security update (RHSA-2022:8850) Moderate: Red Hat OpenStack Platform 16.2.4 (python-ujson) security update (RHSA-2022:8854) Moderate: Red Hat OpenStack Platform 16.2.4 (python-scciclient) security update (RHSA-2022:8851) Low: Red Hat OpenStack Platform 16.2.4 (rabbitmq-server) security update (RHSA-2022:8886) Moderate: redhat-ds:11 security, bug fix, and enhancement update (RHSA-2022:8880) Moderate: java-1.8.0-ibm security update (RHSA-2022:8876) Moderate: Red Hat AMQ Broker 7.10.2 release and security update (RHSA-2022:8833) Moderate: nodejs:18 security, bug fix, and enhancement update (RHSA-2022:8832) Moderate: nodejs:18 security, bug fix, and enhancement update (RHSA-2022:8831) Important: kpatch-patch security update (RHSA-2022:8827) Low: RHACS 3.73 enhancement and security update (RHSA-2022:8812) Moderate: dbus security update (RHSA-2022:8806) Moderate: usbguard security update (RHSA-2022:8800) Moderate: grub2 security update (RHSA-2022:8799) Important: pki-core security update (RHSA-2022:8793) Low: Red Hat JBoss Enterprise Application Platform 7.4.8 security update (RHSA-2022:8791) Low: Red Hat JBoss Enterprise Application Platform 7.4.8 Security update

Cisco Security Advisory

Cisco IP Phone 7800 and 8800 Series Cisco Discovery Protocol Stack Overflow Vulnerability

Microsoft Security

Chromium: CVE-2022-4262 Type Confusion in V8 Chromium: CVE-2022-4174 Type Confusion in V8 Chromium: CVE-2022-4175 Use after free in Camera Capture Chromium: CVE-2022-4177 Use after free in Extensions Chromium: CVE-2022-4178 Use after free in Mojo Chromium: CVE-2022-4179 Use after free in Audio Chromium: CVE-2022-4180 Use after free in Mojo Chromium: CVE-2022-4181 Use after free in Forms Chromium: CVE-2022-4182 Inappropriate implementation in Fenced Frames Chromium: CVE-2022-4183 Insufficient policy enforcement in Popup Blocker Chromium: CVE-2022-4184 Insufficient policy enforcement in Autofill Chromium: CVE-2022-4185 Inappropriate implementation in Navigation Chromium: CVE-2022-4186 Insufficient validation of untrusted input in Downloads Chromium: CVE-2022-4187 Insufficient policy enforcement in DevTools Chromium: CVE-2022-4188 Insufficient validation of untrusted input in CORS Chromium: CVE-2022-4189 Insufficient policy enforcement in DevTools Chromium: CVE-2022-4190 Insufficient data validation in Directory Chromium: CVE-2022-4191 Use after free in Sign-In Chromium: CVE-2022-4192 Use after free in Live Caption Chromium: CVE-2022-4193 Insufficient policy enforcement in File System API Chromium: CVE-2022-4194 Use after free in Accessibility Chromium: CVE-2022-4195 Insufficient policy enforcement in Safe Browsing Microsoft Edge (Chromium-based) Spoofing Vulnerability Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

Github Security Advisories

[GHSA-w3x5-427h-wfq6] Spring Boot Admins integrated notifier support allows arbitrary code execution [GHSA-w9wc-4xcq-8gr6] Akeneo PIM Community Edition vulnerable to remote php code execution [GHSA-gg8r-xjwq-4w92] Cross-site scripting vulnerability in TinyMCE alerts [GHSA-x39j-h85h-3f46] go-merkledag's ProtoNode may be modified such that common method calls may panic [GHSA-9qgp-9wwc-v29r] PrestaShop has potential Information exposure in the upload directory [GHSA-h2ph-vhm7-g4hp] Traefik may display authorization header in the debug logs [GHSA-468w-8x39-gj5v] Traefik routes exposed with an empty TLSOption [GHSA-c4pm-63cg-9j7h] Yauaa vulnerable to ArrayIndexOutOfBoundsException triggered by a crafted Sec-Ch-Ua-Full-Version-List [GHSA-qv4q-mr5r-qprj] Unchecked return value from xmlTextReaderExpand [GHSA-f44q-634c-jvwv] libp2p DoS vulnerability from lack of resource management [GHSA-2qjp-425j-52j9] containerd CRI stream server vulnerable to host memory exhaustion via terminal [GHSA-j7qp-mfxf-8xjw] libp2p DoS vulnerability from lack of resource management [GHSA-43fp-rhv2-5gv8] Certifi removing TrustCor root certificate [GHSA-jvgw-gccv-q5p8] libp2p DoS vulnerability from lack of resource management [GHSA-vx2x-9cff-fhjw] DSInternals Credential Roaming Elevation of Privilege Vulnerability [GHSA-mhhf-vgwh-fw9h] Passeo uses insecure random number generator [GHSA-xr7p-8q82-878q] teler dashboard vulnerable to DOM-based cross-site scripting (XSS) [GHSA-78m5-jpmf-ch7v] GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package [GHSA-x45c-cvp8-q4fm] Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace [GHSA-rf3g-v8p5-p675] NodeBB vulnerable to account takeover via prototype vulnerability [GHSA-4v48-4q5m-8vx4] Prometheus vulnerable to basic authentication bypass [GHSA-qqff-4vw4-f6hx] Cap'n Proto and its Rust implementation vulnerable to out-of-bounds read due to logic error handling list-of-list [GHSA-2r7v-cmch-5x26] muhammara and hummus vulnerable to Unchecked Return Value to NULL Pointer Dereference

CISA Known Exploted Vulnerabilities

Google Chromium V8 Type Confusion Vulnerability CVE-2022-4262

The known exploited vulnerabilities list contains vulnerabilities that are known to be activly exploited. They may not be new or recently discovered. Vulnerabilities listed here were added to this list in the past week.