This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
CVE-2023-35078 is a critical authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows attackers to access restricted application functionality and resources without any authentication. The vulnerability has a CVSS score of 10, indicating maximum severity, with complete compromise of confidentiality, integrity, and availability possible. No user interaction or privileges are required to exploit this flaw, and it affects all versions of the product. While no public exploits are currently known, the vulnerability poses a significant risk to organizations using Ivanti EPMM for mobile device management. European organizations relying on this product for endpoint security could face unauthorized access, data breaches, and operational disruption. Immediate patching or mitigation is critical, though no patches are currently listed. Organizations should implement network-level restrictions, monitor for anomalous access, and consider compensating controls until a fix is available. Countries with high adoption of Ivanti EPMM and critical infrastructure reliance on mobile device management, such as Germany, the UK, France, and the Netherlands, are most at risk.
Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-3519 is a critical unauthenticated remote code execution vulnerability in Citrix NetScaler ADC. It involves improper control of code generation (CWE-94), allowing attackers to execute arbitrary code without authentication. The vulnerability affects specific versions of NetScaler ADC, including 13.0, 13.1, 13.1-FIPS, 12.1-FIPS, and 12.1-NDcPP. It has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. Exploits are known in the wild, and the vulnerability has been used in ransomware campaigns. No patch links are provided in the data, and the product is not a cloud service.
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
SolarView Compact contains a command injection vulnerability in the send test mail console of its web server due to improper input validation. This flaw allows attackers to execute arbitrary commands on the affected system. The vulnerability is known to be exploited in the wild, increasing its risk. No specific affected versions or patch information is provided.
CVE-2023-35311 is a high-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Microsoft 365 Apps for Enterprise, specifically affecting Microsoft Outlook. This flaw allows an attacker to bypass security features, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The vulnerability requires no privileges but does require user interaction, and it can be exploited remotely over the network. Although no known exploits are currently in the wild, the high CVSS score of 8.8 indicates a significant risk. European organizations using Microsoft 365 Apps for Enterprise version 16.0.1 are at risk, especially those with large deployments of Outlook. Mitigation involves applying patches once available, restricting user interaction with untrusted content, and monitoring for suspicious activity. Countries with high Microsoft 365 adoption and strategic targets, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2023-32049 is a high-severity security feature bypass vulnerability affecting Microsoft Windows 10 Version 1809, specifically targeting the Windows SmartScreen feature. This vulnerability allows an attacker to bypass SmartScreen protections, potentially leading to full compromise of confidentiality, integrity, and availability without requiring privileges but needing user interaction. Although no known exploits are currently reported in the wild, the vulnerability's ease of exploitation and impact make it a significant risk. European organizations using Windows 10 Version 1809 are at risk, especially those in sectors with high reliance on legacy systems. Mitigation involves applying available patches or upgrading to supported Windows versions, disabling SmartScreen only as a last resort, and enhancing endpoint protection and user awareness. Countries with higher Windows 10 1809 usage and critical infrastructure reliance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. Given the CVSS 3.1 score of 8.8, this vulnerability is classified as high severity and demands prompt attention from defenders.
CVE-2023-32046 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809, specifically related to the MSHTML platform. The flaw allows an attacker with local access and limited privileges to escalate their rights to higher privileges on the affected system. Exploitation requires user interaction but no prior authentication, and the vulnerability impacts confidentiality, integrity, and availability. Although no known exploits are currently active in the wild, the vulnerability poses a significant risk if leveraged by attackers. The affected version is Windows 10 1809 (build 10.0.17763.0), which remains in use in some environments. European organizations using this legacy OS version are at risk, especially those with critical infrastructure or sensitive data. Mitigation involves applying security updates from Microsoft or upgrading to a supported Windows version.
CVE-2022-31199 is an insecure object deserialization vulnerability in the Netwrix Auditor User Activity Video Recording component. It allows an unauthenticated remote attacker to execute code with NT AUTHORITY\SYSTEM privileges if they can reach port 9004/TCP. This port is commonly blocked by enterprise firewalls. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2021-29256 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver that may allow a non-privileged user to gain root privileges or disclose sensitive information. This vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data.
Samsung mobile devices have a vulnerability in the DSP driver due to improper boundary checks, which allows out-of-bounds memory access. This flaw has been exploited in the wild. No specific affected versions or patches are provided in the available data.
Samsung mobile devices have an unspecified vulnerability in the DSP driver that permits attackers to load ELF libraries inside the DSP. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition. This vulnerability allows a write operation if the attacker has compromised radio privileges. It has been exploited in the wild and is considered a high severity issue.
Samsung mobile devices have an improper input validation vulnerability in the modem interface driver. This flaw is a format string bug that can cause a kernel panic. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition, enabling a write operation if radio privileges are compromised. This vulnerability has been exploited in the wild.
