{"id":8756,"date":"2020-12-04T12:57:09","date_gmt":"2020-12-04T19:57:09","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&#038;p=8756"},"modified":"2023-03-03T14:24:48","modified_gmt":"2023-03-03T21:24:48","slug":"nov-23-csw-patch-watch-security-updates","status":"publish","type":"patch_watch","link":"https:\/\/10.42.32.162\/patch_watch\/nov-23-csw-patch-watch-security-updates\/","title":{"rendered":"Nov 23: CSW Patch Watch &#038; Security Updates"},"content":{"rendered":"<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><img decoding=\"async\" style=\"width: 800px; height: 449px;\" src=\"\/wp-content\/uploads\/2022\/10\/patchwatch-highlights7.png\" alt=\"\" \/><\/span><\/span><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Highlights of the Patch Watch Issue 7<\/strong><\/span><\/span><\/p>\n<ul>\n<li><strong><a href=\"#Findings\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">13 Vendors including Apple, Cisco, Citrix, Chrome, Mozilla, Sonic Wall, Drupal, Checkpoint, RedHat, and others have released patches and updates for 261 vulnerabilities.\u00a0<\/span><\/span><\/a><\/strong><\/li>\n<li><strong><a href=\"#Known exploits\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">33 vulnerabilities are weaponized with known exploits.<\/span><\/span><\/a><\/strong><\/li>\n<li><strong><a href=\"#CISA\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">CISA issued a warning alert for 32 vulnerabilities.<\/span><\/span><\/a><\/strong><\/li>\n<li><strong><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><a href=\"#Old CVEs\">52 Old vulnerabilities are patched this week<\/a>.<\/span><\/span><\/strong><\/li>\n<\/ul>\n<ol>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><a id=\"Findings\" name=\"Findings\"><\/a>Here is our analysis of these <strong>261 vulnerabilities<\/strong> that got patched this week &#8211;<\/span><\/span><\/li>\n<\/ol>\n<ul style=\"margin-left: 40px;\">\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>33 CVEs<\/strong> have known exploits<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>228 CVEs<\/strong> are yet to be weaponized<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>27 CVEs<\/strong> are rated critical, <strong>51 CVEs<\/strong> are of high severity.<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Vulnerabilities that had known exploits are associated with Denial of Service, Remote Code Execution, Web apps, and others.<\/span><\/span><\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 500px; height: 386px;\" src=\"\/wp-content\/uploads\/2022\/10\/in-a-total-of-261-vulnerabilities.png\" alt=\"\" \/><\/p>\n<ol>\n<li value=\"2\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><a id=\"Known exploits\" name=\"Known exploits\"><\/a>Among the <strong>33 weaponized<\/strong> vulnerabilities &#8211;<\/span><\/span><\/li>\n<\/ol>\n<ul style=\"margin-left: 40px;\">\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>30 CVEs<\/strong> were patched by Check Point<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>16 CVEs<\/strong> are linked with Web App exploits<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>13 CVEs<\/strong> have Remote Code Execution flaw<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>3 CVEs<\/strong> were associated with Denial of Service<\/span><\/span><\/li>\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>1 CVE<\/strong> can be exploited in any form.<\/span><\/span><\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 500px; height: 326px;\" src=\"\/wp-content\/uploads\/2022\/10\/analysis-of-weaponization1.png\" alt=\"\" \/><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>82%<\/strong> of vulnerabilities are associated with <strong>Web application exploits<\/strong> where attackers can infect computers with malware, stage phishing attacks to grab credentials, and perform actions posing as the user.<\/span><\/span><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrNIPMX4iBYGwd7A?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p><span style=\"font-size: 14px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Table 1: Weaponized Vulnerabilities<\/strong><\/span><\/span><\/p>\n<ol>\n<li value=\"3\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><a id=\"CISA\" name=\"CISA\"><\/a>CISA has issued alerts for <strong>32 vulnerabilities<\/strong> and has urged to evaluate cyber-risk on your valuable assets.<\/span><\/span><\/li>\n<\/ol>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><img decoding=\"async\" style=\"width: 500px; height: 386px;\" src=\"\/wp-content\/uploads\/2022\/10\/cisa-alerts1.png\" alt=\"\" \/><\/span><\/span><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shryiJgb7FVFKUeeR?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p><span style=\"font-size: 14px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Table 2: CISA Alerts<\/strong><\/span><\/span><\/p>\n<ol>\n<li value=\"4\"><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><a id=\"Old CVEs\" name=\"Old CVEs\"><\/a>We have <strong>52 old vulnerabilities<\/strong> patched for this week, ranging from 2010 &#8211; 2019.<\/span><\/span><\/li>\n<\/ol>\n<ul style=\"margin-left: 40px;\">\n<li><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Out of <strong>52 CVEs<\/strong>,<strong> 6 CVEs<\/strong> are critical, <strong>13 CVEs<\/strong> are ranked high, <strong>28<\/strong> with medium severity, and <strong>4<\/strong> of low.<\/span><\/span><\/li>\n<\/ul>\n<p><img decoding=\"async\" style=\"width: 500px; height: 386px;\" src=\"\/wp-content\/uploads\/2022\/10\/old-vulnerabilities2.png\" alt=\"\" \/><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shrHQh1I9iYWe07bM?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p><span style=\"font-size: 14px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Table 3: Old Vulnerabilities<\/strong><\/span><\/span><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Prioritization on unpatched old vulnerabilities is important as the risk of having those vulnerabilities exploited by threat actors are higher than ever.<\/span><\/span><\/p>\n<p><iframe class=\"airtable-embed\" style=\"background: transparent; border: 1px solid #ccc;\" src=\"https:\/\/airtable.com\/embed\/shr8DLkyZ1PndhaOo?backgroundColor=purple&amp;viewControls=on\" width=\"100%\" height=\"533\" frameborder=\"0\"><\/iframe><\/p>\n<p><span style=\"font-size: 14px;\"><span style=\"font-family: verdana,geneva,sans-serif;\"><strong>Table 4: Vulnerabilities yet to be Weaponized<\/strong><\/span><\/span><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Cyber hygiene has become a catchphrase this year and with good reason. Most organizations don\u2019t practice it and therefore fall prey to cyber-attacks. <strong>Securing your attack surface is always better than dealing with the aftermath of an incident. <\/strong><\/span><\/span><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Happy Patching<\/span><\/span><\/p>\n<p><span style=\"font-size: 16px;\"><span style=\"font-family: verdana,geneva,sans-serif;\">Team CSW<\/span><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Highlights of the Patch Watch Issue 7 13 Vendors including Apple, Cisco, Citrix, Chrome, Mozilla, Sonic Wall, Drupal, Checkpoint, RedHat, and others have released patches and updates for 261 vulnerabilities.\u00a0 33 vulnerabilities are weaponized with known exploits. CISA issued a warning alert for 32 vulnerabilities. 52 Old vulnerabilities are patched this week. Here is our [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":14453,"parent":0,"menu_order":0,"template":"","meta":{"content-type":""},"patch_category":[],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch\/8756"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_watch"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/patch_watch"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/14453"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=8756"}],"wp:term":[{"taxonomy":"patch_category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/patch_category?post=8756"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}