MITER updates list of 25 most dangerous software bugs

MITER this year shared a list of the top 25 most common and dangerous software weaknesses over the past two years.

Software weaknesses are flaws, bugs, vulnerabilities, and various other types of errors affecting the code, architecture, implementation, or design of a software solution, potentially exposing the systems on which it runs. to attacks.

MITER developed the Top 25 list using 2019 and 2020 Common Vulnerability and Exposure (CVE) data obtained from the National Vulnerability Database (NVD) (approximately 27,000 CVE).

“A scoring formula is used to calculate a ranked order of weaknesses that combines the frequency with which a CWE is the root cause of a vulnerability with the projected severity of its exploitation,” explained MITER.

“This approach provides an objective look at vulnerabilities currently seen in the real world, creates a basis of analytical rigor based on publicly reported vulnerabilities instead of surveys and subjective opinions, and makes the process easily replicable.”

The 25 best MITER bugs 2021 are dangerous because they are generally easy to discover, have a high impact, and are prevalent in software released over the past two years.

They can also be exploited by attackers to potentially take full control of vulnerable systems, steal sensitive data from targets, or trigger a denial of service (DoS) after successful exploitation.

The list below gives the community at large an overview of the most critical and current weaknesses in software security.

Top 10 most exploited vulnerabilities

Last year, on May 12, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) also published a list of the 10 most exploited security vulnerabilities between 2016 and 2019.

“Of the top 10, the three most common vulnerabilities used by state sponsored cyber actors from China, Iran, North Korea and Russia are CVE-2017-11882, CVE-2017-0199, and CVE- 2012-0158 “, CISA mentioned. “These three vulnerabilities are related to Microsoft’s OLE technology.”

Chinese hackers have frequently exploited CVE-2012-0158 from December 2018, showing that their targets have failed to quickly apply security updates and that malicious actors will continue to try to abuse so many bugs. that they are not corrected.

Attackers have also focused on exploiting security holes caused by hasty deployments of cloud collaboration services like Office 365.

Unpatched vulnerabilities Pulse Secure VPN (CVE-2019-11510) and Citrix VPN (CVE-2019-19781) were also a favorite target last year, after the switch to remote working caused by the COVID-pandemic. 19 in progress.

CISA recommends abandoning end-of-life software as soon as possible, as it is the easiest and fastest way to mitigate old, unpatched security bugs.

The full list of the 10 most exploited security vulnerabilities since 2016 can be found below, with direct links to their NVD entries.