The FBI and Cybersecurity and Infrastructure Security Agency and the U.S. government developed a list of the most routinely exploited vulnerabilities by cyberattackers, and they recommend organizations implement patches wherever possible.
The vulnerabilities include:
1. CVE-2017-11882 within Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016 products and associated with Loki, FormBook and Pony/FAREIT malware.
2. CVE-2017-0199 within Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 and associated with LATENTBOT and Dridex malware.
3. CVE-2017-5638 within Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 and associated with JexBoss malware.
4. CVE-2012-0158 within Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 and associated with Dridex malware.
5. CVE-2019-0604 within Microsoft SharePoint and associated with China Chopper malware.
6. CVE-2017-0143 within Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 and associated with Multiple using the EternalSynergy and EternalBlue Exploit Kit malware.
7. CVE-2018-4878 within Adobe Flash Player before 28.0.0.161 associated with DOGCALL malware.
8. CVE-2017-8759 within Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 and associated with FINSPY, FinFisher and WingBird malware.
9. CVE-2015-1641 within Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 and associated with Toshliph and UWarrior malware.
10. CVE-2018-7600 within Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 and associated with Kitty malware.
More articles on cybersecurity:
Ohio hospital inadvertently posts spreadsheet with 3,683 patients' information on website
Magellan Health hit by ransomware attack
7 hospitals whose employees wrongfully viewed patient records