Trend Micro Apex One customers have been warned by the security software provider to immediately apply fixes to an actively abused security flaw, tracked as CVE-2022-40139, which could enable remote execution of arbitrary code on unpatched instances, reports BleepingComputer.
"Trend Micro has observed at least one active attempt of potential exploitation of this vulnerability in the wild. Customers are strongly encouraged to update to the latest versions as soon as possible," said the company, which noted that the flaw stemmed from improper validation of certain rollback mechanism components within Trend Micro Apex One and Trend Micro Apex One as a Service.
Aside from the actively exploited bug, Trend Micro has also fixed a high-severity Apex One flaw, tracked as CVE-2022-40144, which could facilitate authentication bypass.
"Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible," said Trend Micro.
Included in the exposed dataset labeled "PDL" were individuals' full names, email addresses, phone numbers, location data, professional summaries, and skills, as well as education and employment histories.
Attackers could leverage the issue — which impacts Nexus 3000, 7000, and 9000 series switches with vulnerable NX-OS versions with DHCPv6 activated and are in standalone NX-OS mode — to facilitate continuous crashes of the dhcp_snoop process and a denial-of-service condition.
Higher rewards of up to $250,000 will be given by Google for the discovery of memory corruption flaws in the Chrome browser shown to achieve remote code execution using a non-sandboxed process as part of a more robust vulnerability reward program.