CVE-2023-3519 is a critical unauthenticated remote code execution vulnerability in Citrix NetScaler ADC. It involves improper control of code generation (CWE-94), allowing attackers to execute arbitrary code without authentication. The vulnerability affects specific versions of NetScaler ADC, including 13.0, 13.1, 13.1-FIPS, 12.1-FIPS, and 12.1-NDcPP. It has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. Exploits are known in the wild, and the vulnerability has been used in ransomware campaigns. No patch links are provided in the data, and the product is not a cloud service.
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
SolarView Compact contains a command injection vulnerability in the send test mail console of its web server due to improper input validation. This flaw allows attackers to execute arbitrary commands on the affected system. The vulnerability is known to be exploited in the wild, increasing its risk. No specific affected versions or patch information is provided.
CVE-2023-35311 is a high-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Microsoft 365 Apps for Enterprise, specifically affecting Microsoft Outlook. This flaw allows an attacker to bypass security features, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The vulnerability requires no privileges but does require user interaction, and it can be exploited remotely over the network. Although no known exploits are currently in the wild, the high CVSS score of 8.8 indicates a significant risk. European organizations using Microsoft 365 Apps for Enterprise version 16.0.1 are at risk, especially those with large deployments of Outlook. Mitigation involves applying patches once available, restricting user interaction with untrusted content, and monitoring for suspicious activity. Countries with high Microsoft 365 adoption and strategic targets, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2023-32049 is a high-severity security feature bypass vulnerability affecting Microsoft Windows 10 Version 1809, specifically targeting the Windows SmartScreen feature. This vulnerability allows an attacker to bypass SmartScreen protections, potentially leading to full compromise of confidentiality, integrity, and availability without requiring privileges but needing user interaction. Although no known exploits are currently reported in the wild, the vulnerability's ease of exploitation and impact make it a significant risk. European organizations using Windows 10 Version 1809 are at risk, especially those in sectors with high reliance on legacy systems. Mitigation involves applying available patches or upgrading to supported Windows versions, disabling SmartScreen only as a last resort, and enhancing endpoint protection and user awareness. Countries with higher Windows 10 1809 usage and critical infrastructure reliance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. Given the CVSS 3.1 score of 8.8, this vulnerability is classified as high severity and demands prompt attention from defenders.
CVE-2023-32046 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809, specifically related to the MSHTML platform. The flaw allows an attacker with local access and limited privileges to escalate their rights to higher privileges on the affected system. Exploitation requires user interaction but no prior authentication, and the vulnerability impacts confidentiality, integrity, and availability. Although no known exploits are currently active in the wild, the vulnerability poses a significant risk if leveraged by attackers. The affected version is Windows 10 1809 (build 10.0.17763.0), which remains in use in some environments. European organizations using this legacy OS version are at risk, especially those with critical infrastructure or sensitive data. Mitigation involves applying security updates from Microsoft or upgrading to a supported Windows version.
CVE-2022-31199 is an insecure object deserialization vulnerability in the Netwrix Auditor User Activity Video Recording component. It allows an unauthenticated remote attacker to execute code with NT AUTHORITY\SYSTEM privileges if they can reach port 9004/TCP. This port is commonly blocked by enterprise firewalls. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
CVE-2021-29256 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver that may allow a non-privileged user to gain root privileges or disclose sensitive information. This vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data.
Samsung mobile devices have a vulnerability in the DSP driver due to improper boundary checks, which allows out-of-bounds memory access. This flaw has been exploited in the wild. No specific affected versions or patches are provided in the available data.
Samsung mobile devices have an unspecified vulnerability in the DSP driver that permits attackers to load ELF libraries inside the DSP. This vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition, enabling a write operation if radio privileges are compromised. This vulnerability has been exploited in the wild.
Samsung mobile devices have a race condition vulnerability in the MFC charger driver that can lead to a use-after-free condition. This vulnerability allows a write operation if the attacker has compromised radio privileges. It has been exploited in the wild and is considered a high severity issue.
The D-Link DIR-859 router has a command execution vulnerability in its UPnP service at the /gena.cgi endpoint. An unauthenticated remote attacker on the local network can exploit this flaw by sending a specially crafted HTTP SUBSCRIBE request, allowing execution of system commands with root privileges. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2019-20500 is an authenticated command injection vulnerability in the D-Link DWL-2600AP access point. It occurs via the Save Configuration functionality in the web interface, where shell metacharacters can be injected through the admin.cgi?action=config_save configBackup or downloadServerip parameters. This vulnerability has been exploited in the wild.
CVE-2021-25487 is an out-of-bounds read vulnerability in Samsung mobile devices affecting the modem interface driver. It arises from insufficient boundary checking in the set_skb_priv() function, which can lead to remote code execution by dereferencing an invalid function pointer. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.
Samsung mobile devices have an improper input validation vulnerability in the modem interface driver. This flaw is a format string bug that can cause a kernel panic. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
CVE-2023-32435 is a high-severity memory corruption vulnerability in Apple macOS and iOS that allows arbitrary code execution when processing web content. It affects versions of iOS prior to 15.7 and macOS versions before Ventura 13.3, as well as Safari 16.4 and related OS versions. The flaw arises from improper state management leading to memory corruption (CWE-787). Apple has released patches in macOS Ventura 13.3, iOS 16.4, iPadOS 16.4, and iOS/iPadOS 15.
CVE-2023-32439 is a high-severity type confusion vulnerability in Apple iOS, iPadOS, macOS Ventura, and Safari that allows arbitrary code execution when processing maliciously crafted web content. The flaw arises from insufficient type checks, which Apple has addressed in iOS 16.5.1, iPadOS 16.5.1, iOS 15.7.7, iPadOS 15.7.7, macOS Ventura 13.
CVE-2023-32434 is a high-severity vulnerability in Apple operating systems including macOS, iOS, iPadOS, and watchOS, caused by an integer overflow that allows an app to execute arbitrary code with kernel privileges. The flaw affects versions prior to the patched releases such as iOS 15.7.7 and macOS Big Sur 11.7.8. Exploitation requires local access and user interaction but no prior authentication. Apple has addressed the issue through improved input validation in multiple OS updates. Although no confirmed active exploitation is reported, Apple acknowledges potential active exploitation on iOS versions before 15.7.
