Category Archives: Advisories

Advisories

CVE-2021-20464

Read Time:11 Second

IBM Cognos Analytics PowerPlay (IBM Cognos Analytics 11.1.7, 11.2.0, and 11.1.7) could be vulnerable to an XML Bomb attack by a malicious authenticated user. IBM X-Force ID: 196813.

Read More

Advisories

CVE-2020-14123

Read Time:18 Second

There is a pointer double free vulnerability in Some MIUI Services. When a function is called, the memory pointer is copied to two function modules, and an attacker can cause the pointer to be repeatedly released through malicious operations, resulting in the affected module crashing and affecting normal functionality, and if successfully exploited the vulnerability can cause elevation of privileges.

Read More

Advisories

CVE-2022-22718 on CISA’s Known Exploited Vulnerabilities Catalog

Read Time:1 Minute, 17 Second

FortiGuard Labs is aware that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-22718 to the Known Exploited Vulnerabilities Catalog. CVE-2022-24481 is a local privilege escalation vulnerability in the Windows Print Spooler and affects multiple versions of Windows OS. Microsoft issued a patch for the vulnerability as part of the February 2022 Patch Tuesday updates.Why is this Significant?This is significant because CISA’s Known Exploited Vulnerabilities Catalog lists vulnerabilities that are known to be exploited in the wild. Although Microsoft rated CVE-2022-22718 as “Exploitation More Likely” in their advisory, the vulnerability is now on the active exploitation list as such the patch for CVE-2022-22718 should be applied as soon as possible.What is CVE-2022-22718?CVE-2022-22718 is a local privilege escalation vulnerability in the Windows Print Spooler and affects multiple versions of Windows OS. Successfully exploiting the vulnerability allows a local attacker to elevate privileges. CVE-2022-22718 has a CVSS score of 7.8. Has Microsoft Released an Advisory for CVE-2022-22718?Yes, Microsoft released an advisory on February 8, 2022. See the Appendix for a link to “Windows Print Spooler Elevation of Privilege Vulnerability – CVE-2022-22718”.Has Microsoft Released a Patch for CVE-2022-22718?Yes, Microsoft released a patch as part of the February 2022 Patch Tuesday (February 8th, 2022).What is the Status of Coverage?FortiGuard Labs has the following IPS signature against CVE-2022-22718:MS.Windows.Print.Spooler.CVE-2022-22718.Privilege.Elevation

Read More