Threat database

CVE-2023-36025 is a high-severity vulnerability in Microsoft Windows SmartScreen that allows attackers to bypass Windows Defender SmartScreen security checks and prompts. This bypass could enable execution of malicious content without the usual warnings. The vulnerability has been exploited in the wild, increasing its risk. No specific affected Windows versions or patch information is provided in the available data.

CVE-2023-36036 is a privilege escalation vulnerability in the Microsoft Windows Cloud Files Mini Filter Driver. This flaw allows an attacker with limited privileges to escalate to SYSTEM privileges. The vulnerability has a high severity score of 7.8 and has been exploited in the wild. No specific affected versions or patch information is provided in the available data.

In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.

Apache ActiveMQ has a critical deserialization of untrusted data vulnerability (CVE-2023-46604) that allows remote attackers with network access to execute shell commands on the broker. This is achieved by manipulating serialized class types in the OpenWire protocol, causing the broker to instantiate arbitrary classes on its classpath. The vulnerability has a CVSS score of 10.0 and is known to be exploited in the wild, including use in ransomware campaigns.

All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to Confluence instance administrator leading to - but not limited to - full loss of confidentiality, integrity and availability.  Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.

CVE-2023-46747 is a critical authentication bypass vulnerability in the F5 BIG-IP Configuration Utility. It allows an unauthenticated attacker with network access to the management port or self IP addresses to execute system commands. This vulnerability can be exploited without user interaction and has been observed in the wild. It is associated with high impact on confidentiality, integrity, and availability. The vulnerability may be combined with CVE-2023-46748 for further exploitation.

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated

NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the incomplete patch of CVE-2023-37679.

CVE-2023-34048 is a critical out-of-bounds write vulnerability in VMware vCenter Server versions 7.0 and 8.0, specifically in the DCERPC protocol implementation. This flaw allows a remote attacker with network access to the vCenter Server to trigger memory corruption that can lead to remote code execution without requiring authentication or user interaction. The vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and the critical nature of vCenter Server in enterprise environments make this a significant threat. European organizations relying on VMware vCenter for virtualization management are at high risk, especially in countries with large enterprise IT infrastructures. Immediate patching or mitigation is essential to prevent potential compromise. Defenders should prioritize network segmentation, restrict access to vCenter Server, and monitor for suspicious activity related to DCERPC traffic.

A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier allow a remote unauthenticated attacker to conduct XML External Entity (XXE) attacks. By processing a specially crafted request containing malformed XML data, arbitrary files on the server containing account information may be read by the attacker.

CVE-2023-20198 is a critical privilege escalation vulnerability in the Cisco IOS XE Web UI. It allows a remote, unauthenticated attacker to create an account with the highest privilege level (15), enabling full control over the affected device. This vulnerability has a CVSS score of 10.0 and has been exploited in the wild.

Microsoft WordPad Information Disclosure Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Skype for Business Elevation of Privilege Vulnerability

Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server.

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.

Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances. Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.