A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash.
This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.
Adobe Acrobat Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier) and 20.005.30418 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input to the web UI. A successful exploit could allow the attacker to inject commands to the underlying operating system with root privileges.
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.6.
In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.
The Contagious Interview campaign is a coordinated cyber espionage operation by North Korean threat actors, notably linked to the Lazarus group, targeting the cryptocurrency sector. These actors actively monitor cyber threat intelligence platforms such as Validin, VirusTotal, and Maltrail to identify exposed infrastructure and new targets. They prioritize rapid deployment of malicious infrastructure over stealth and use social engineering techniques, including the ClickFix method, to trick victims into executing malware. Between January and March 2025, over 230 victims were engaged, demonstrating the campaign's scale and sophistication. Although no known exploits for CVE-2023-42793 have been observed in the wild, the campaign poses a medium severity threat. European cryptocurrency organizations, especially in countries with significant crypto markets and financial sectors, are at risk. Mitigation requires targeted monitoring of threat intelligence platforms, enhanced user training against social engineering, and rapid incident response capabilities.
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-20198 is a critical privilege escalation vulnerability in the Cisco IOS XE Web UI. It allows a remote, unauthenticated attacker to create an account with the highest privilege level (15), enabling full control over the affected device. This vulnerability has a CVSS score of 10.0 and has been exploited in the wild.
CVE-2018-14667 is a high severity expression language injection vulnerability in the Red Hat JBoss RichFaces Framework. It affects the UserResource resource, allowing a remote, unauthenticated attacker to execute malicious code by exploiting a chain of Java serialized objects. This vulnerability has been observed in the wild.
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in publicly accessible Confluence Data Center and Server instances to create unauthorized Confluence administrator accounts and access Confluence instances.
Atlassian Cloud sites are not affected by this vulnerability. If your Confluence site is accessed via an atlassian.net domain, it is hosted by Atlassian and is not vulnerable to this issue.
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free Business Security Services could allow an attacker to manipulate the module to execute arbitrary commands on an affected installation.
Note that an attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.
CVE-2023-28434 is a security feature bypass vulnerability in MinIO that allows attackers with specific permissions to bypass bucket name checks and place objects into arbitrary buckets, enabling privilege escalation. Exploitation requires credentials with arn:aws:s3:::* permission and enabled Console API access. This vulnerability has been exploited in the wild.
CVE-2014-8361 is a high-severity vulnerability in the Realtek SDK's miniigd SOAP service caused by improper input validation. This flaw allows remote attackers to execute arbitrary code by sending a specially crafted NewInternalClient request. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
A use-after-free vulnerability exists in Samsung mobile devices with selected Exynos chipsets. This flaw allows malicious actors to perform unauthorized memory writes and potentially execute arbitrary code on affected devices. The vulnerability has been exploited in the wild. No specific affected software versions or patches have been provided in the available data.
