Zyxel EMG2926 routers have a command injection vulnerability in the diagnostic nslookup function. This flaw allows attackers to execute arbitrary commands on the device by manipulating parameters such as ping_ip in the diagnostic URI. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns.
A use-after-free vulnerability exists in Samsung mobile devices with selected Exynos chipsets. This flaw allows malicious actors to perform unauthorized memory writes and potentially execute arbitrary code on affected devices. The vulnerability has been exploited in the wild. No specific affected software versions or patches have been provided in the available data.
Acrobat Reader versions 23.003.20284 (and earlier), 20.005.30516 (and earlier) and 20.005.30514 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
CVE-2023-35674 is a high-severity local privilege escalation vulnerability in Google Android versions 11 through 13, caused by a logic error in WindowState.java's onCreate method. This flaw allows an attacker with limited privileges to launch a background activity, escalating their privileges without requiring additional execution rights or user interaction. The vulnerability impacts confidentiality, integrity, and availability, enabling potential full system compromise. Exploitation does not require user interaction but does require local access with some privileges. No known exploits are currently in the wild, but the vulnerability's critical nature and broad Android version impact make it a significant risk. European organizations using affected Android devices, especially in sectors with sensitive data, face elevated risks. Mitigation involves applying official patches once available, restricting local access, and monitoring for suspicious activity related to background activity launches. Countries with high Android adoption and critical infrastructure reliance on mobile devices, such as Germany, France, and the UK, are most likely to be affected. Given the CVSS score of 8.
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or an authenticated, remote attacker to establish a clientless SSL VPN session with an unauthorized user.
This vulnerability is due to improper separation of authentication, authorization, and accounting (AAA) between the remote access VPN feature and the HTTPS management and site-to-site VPN features. An attacker could exploit this vulnerability by specifying a default connection profile/tunnel group while conducting a brute force attack or while establishing a clientless SSL VPN session using valid credentials. A successful exploit could allow the attacker to achieve one or both of the following:
Identify valid credentials that could then be used to establish an unauthorized remote access VPN session.
Establish a clientless SSL VPN session (only when running Cisco ASA Software Release 9.16 or earlier).
Notes:
Establishing a client-based remote access VPN tunnel is not possible as these default connection profiles/tunnel groups do not and cannot have an IP address pool configured.
This vulnerability does not allow an attacker to bypass authentication. To successfully establish a remote access VPN session, valid credentials are required, including a valid second factor if multi-factor authentication (MFA) is configured.
Cisco will release software updates that address this vulnerability. There are workarounds that address this vulnerability.
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may result in arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-33246 is a critical remote code execution vulnerability in Apache RocketMQ versions 5.1.0 and below. The vulnerability arises because several RocketMQ components exposed on the extranet lack proper permission verification, allowing attackers to exploit the update configuration function or forge protocol content to execute arbitrary commands with the privileges of the RocketMQ process. This flaw affects NameServer, Broker, and Controller components. No authentication or user interaction is required, and the vulnerability has a CVSS score of 9.8, indicating a severe risk to confidentiality, integrity, and availability. Users are strongly advised to upgrade to RocketMQ 5.1.1 or above, or 4.
CVE-2023-38831 is a high-severity remote code execution vulnerability affecting WinRAR versions prior to 6.23. The flaw allows an attacker to execute malicious code when a user opens a specially crafted ZIP archive containing a benign file and a folder with the same name. Exploitation requires user interaction but no privileges or authentication. This vulnerability was actively exploited in the wild from April to October 2023. The CVSS score of 7.8 reflects significant impact on confidentiality, integrity, and availability. European organizations using vulnerable WinRAR versions, especially those processing ZIP files from untrusted sources, are at risk. Mitigation involves updating WinRAR to version 6.23 or later and implementing strict archive handling policies.
CVE-2023-32315 is a high-severity path traversal vulnerability in the Openfire XMPP server's administrative console setup environment. It allows unauthenticated attackers to access restricted administrative pages by exploiting improper pathname restrictions. This affects all Openfire versions released since April 2015 up to versions before 4.6.8 and 4.7.5, with patches available in those versions. The vulnerability enables attackers to gain partial administrative access without credentials, potentially compromising confidentiality and availability. No known exploits are currently in the wild, but the ease of exploitation and broad version impact make timely patching critical. European organizations using Openfire should prioritize upgrading to patched versions or apply mitigations from the GitHub advisory.
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.
CVE-2023-27532 is a high severity vulnerability in Veeam Backup & Replication versions prior to 12.0.0.1420. It involves missing authentication for a critical function, allowing attackers to obtain encrypted credentials stored in the configuration database. This exposure can lead to unauthorized access to backup infrastructure hosts. The vulnerability has a CVSS score of 7.5 and is known to be exploited in the wild, including use in ransomware campaigns.
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
Zyxel P660HN-T1A routers have a command injection vulnerability in the Remote System Log forwarding feature. This flaw is exploitable by unauthenticated users via the remote_host parameter on the ViewLog.asp page. The vulnerability has been exploited in the wild and is considered high severity.
