CISA Warns of Apple & Oracle Agile Vulnerabilities Exploited in Wild
- С сайта: Vulnerability(cybersecuritynews.com)
- Вернуться к списку новостей
С сайта: Vulnerability(cybersecuritynews.com)
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding three critical vulnerabilities affecting Apple and Oracle products.
These flaws, identified as CVE-2024-44308, CVE-2024-44309, and CVE-2024-21287, have the potential to be exploited in the wild, posing significant cybersecurity risks to organizations and individuals.
CVE-2024-44308: Apple Code Execution Vulnerability
The vulnerability, CVE-2024-44308, affects multiple Apple products, including iOS and macOS.
It involves an unspecified flaw in how these systems process maliciously crafted web content, potentially allowing attackers to execute arbitrary code on target devices.
This could give malicious actors access to sensitive data or control over compromised systems.
Apple has advised users to apply the latest security updates immediately or, if no fixes are available, to discontinue use of vulnerable products. The deadline for mitigation is December 12, 2024.
CVE-2024-44309: Apple Cross-Site Scripting (XSS) Vulnerability
Another vulnerability, CVE-2024-44309, also impacts Apple’s ecosystem.
This flaw can be exploited to launch cross-site scripting (XSS) attacks. By crafting malicious web content, attackers could inject harmful scripts into a user’s browser, potentially enabling data theft, session hijacking, or other types of malicious activity.
Similar to the first vulnerability, Apple has urged users to stay updated with the latest patches or discontinue the use of affected devices if no solutions exist. Mitigation is required by December 12, 2024.
CVE-2024-21287: Oracle Agile PLM Incorrect Authorization Vulnerability
Oracle’s Agile Product Lifecycle Management (PLM) software is affected by CVE-2024-21287.
This vulnerability stems from incorrect authorization in the Process Extension component of its Software Development Kit.
If exploited, it could result in unauthenticated file disclosure, potentially exposing confidential business or personal information.
Oracle has released mitigation guidelines for users to address this issue, with a similar deadline of December 12, 2024, for resolution.
CISA strongly advises organizations to act swiftly to mitigate these vulnerabilities.
Failure to do so could expose systems to potential exploitation by malicious actors. Although there is no confirmation of active ransomware campaigns leveraging these vulnerabilities, the risks remain significant.
Administrators should prioritize patch management, monitor for unusual activity, and implement additional security measures to safeguard systems. For detailed instructions, refer to Apple and Oracle’s official advisories.
#Apple #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
CISA Warns of Apple & Oracle Agile Vulnerabilities Exploited in Wild
Author: DhivyaThe Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding three critical vulnerabilities affecting Apple and Oracle products.
These flaws, identified as CVE-2024-44308, CVE-2024-44309, and CVE-2024-21287, have the potential to be exploited in the wild, posing significant cybersecurity risks to organizations and individuals.
CVE-2024-44308: Apple Code Execution Vulnerability
The vulnerability, CVE-2024-44308, affects multiple Apple products, including iOS and macOS.
It involves an unspecified flaw in how these systems process maliciously crafted web content, potentially allowing attackers to execute arbitrary code on target devices.
This could give malicious actors access to sensitive data or control over compromised systems.
Apple has advised users to apply the latest security updates immediately or, if no fixes are available, to discontinue use of vulnerable products. The deadline for mitigation is December 12, 2024.
CVE-2024-44309: Apple Cross-Site Scripting (XSS) Vulnerability
Another vulnerability, CVE-2024-44309, also impacts Apple’s ecosystem.
This flaw can be exploited to launch cross-site scripting (XSS) attacks. By crafting malicious web content, attackers could inject harmful scripts into a user’s browser, potentially enabling data theft, session hijacking, or other types of malicious activity.
Similar to the first vulnerability, Apple has urged users to stay updated with the latest patches or discontinue the use of affected devices if no solutions exist. Mitigation is required by December 12, 2024.
CVE-2024-21287: Oracle Agile PLM Incorrect Authorization Vulnerability
Oracle’s Agile Product Lifecycle Management (PLM) software is affected by CVE-2024-21287.
This vulnerability stems from incorrect authorization in the Process Extension component of its Software Development Kit.
If exploited, it could result in unauthenticated file disclosure, potentially exposing confidential business or personal information.
Oracle has released mitigation guidelines for users to address this issue, with a similar deadline of December 12, 2024, for resolution.
CISA strongly advises organizations to act swiftly to mitigate these vulnerabilities.
Failure to do so could expose systems to potential exploitation by malicious actors. Although there is no confirmation of active ransomware campaigns leveraging these vulnerabilities, the risks remain significant.
Administrators should prioritize patch management, monitor for unusual activity, and implement additional security measures to safeguard systems. For detailed instructions, refer to Apple and Oracle’s official advisories.
#Apple #Cyber_Security_News #Vulnerability #cyber_security #cyber_security_news
Оригинальная версия на сайте:
