This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
CVE-2023-35078 is a critical authentication bypass vulnerability in Ivanti Endpoint Manager Mobile (EPMM) that allows attackers to access restricted application functionality and resources without any authentication. The vulnerability has a CVSS score of 10, indicating maximum severity, with complete compromise of confidentiality, integrity, and availability possible. No user interaction or privileges are required to exploit this flaw, and it affects all versions of the product. While no public exploits are currently known, the vulnerability poses a significant risk to organizations using Ivanti EPMM for mobile device management. European organizations relying on this product for endpoint security could face unauthorized access, data breaches, and operational disruption. Immediate patching or mitigation is critical, though no patches are currently listed. Organizations should implement network-level restrictions, monitor for anomalous access, and consider compensating controls until a fix is available. Countries with high adoption of Ivanti EPMM and critical infrastructure reliance on mobile device management, such as Germany, the UK, France, and the Netherlands, are most at risk.
Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
CVE-2023-3519 is a critical unauthenticated remote code execution vulnerability in Citrix NetScaler ADC. It involves improper control of code generation (CWE-94), allowing attackers to execute arbitrary code without authentication. The vulnerability affects specific versions of NetScaler ADC, including 13.0, 13.1, 13.1-FIPS, 12.1-FIPS, and 12.1-NDcPP. It has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. Exploits are known in the wild, and the vulnerability has been used in ransomware campaigns. No patch links are provided in the data, and the product is not a cloud service.
SolarView Compact contains a command injection vulnerability in the send test mail console of its web server due to improper input validation. This flaw allows attackers to execute arbitrary commands on the affected system. The vulnerability is known to be exploited in the wild, increasing its risk. No specific affected versions or patch information is provided.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
CVE-2023-35311 is a high-severity Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Microsoft 365 Apps for Enterprise, specifically affecting Microsoft Outlook. This flaw allows an attacker to bypass security features, potentially leading to full compromise of confidentiality, integrity, and availability of affected systems. The vulnerability requires no privileges but does require user interaction, and it can be exploited remotely over the network. Although no known exploits are currently in the wild, the high CVSS score of 8.8 indicates a significant risk. European organizations using Microsoft 365 Apps for Enterprise version 16.0.1 are at risk, especially those with large deployments of Outlook. Mitigation involves applying patches once available, restricting user interaction with untrusted content, and monitoring for suspicious activity. Countries with high Microsoft 365 adoption and strategic targets, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2023-32049 is a high-severity security feature bypass vulnerability affecting Microsoft Windows 10 Version 1809, specifically targeting the Windows SmartScreen feature. This vulnerability allows an attacker to bypass SmartScreen protections, potentially leading to full compromise of confidentiality, integrity, and availability without requiring privileges but needing user interaction. Although no known exploits are currently reported in the wild, the vulnerability's ease of exploitation and impact make it a significant risk. European organizations using Windows 10 Version 1809 are at risk, especially those in sectors with high reliance on legacy systems. Mitigation involves applying available patches or upgrading to supported Windows versions, disabling SmartScreen only as a last resort, and enhancing endpoint protection and user awareness. Countries with higher Windows 10 1809 usage and critical infrastructure reliance, such as Germany, France, Italy, Spain, and the UK, are most likely affected. Given the CVSS 3.1 score of 8.8, this vulnerability is classified as high severity and demands prompt attention from defenders.
CVE-2023-32046 is a high-severity elevation of privilege vulnerability affecting Microsoft Windows 10 Version 1809, specifically related to the MSHTML platform. The flaw allows an attacker with local access and limited privileges to escalate their rights to higher privileges on the affected system. Exploitation requires user interaction but no prior authentication, and the vulnerability impacts confidentiality, integrity, and availability. Although no known exploits are currently active in the wild, the vulnerability poses a significant risk if leveraged by attackers. The affected version is Windows 10 1809 (build 10.0.17763.0), which remains in use in some environments. European organizations using this legacy OS version are at risk, especially those with critical infrastructure or sensitive data. Mitigation involves applying security updates from Microsoft or upgrading to a supported Windows version.
CVE-2022-31199 is an insecure object deserialization vulnerability in the Netwrix Auditor User Activity Video Recording component. It allows an unauthenticated remote attacker to execute code with NT AUTHORITY\SYSTEM privileges if they can reach port 9004/TCP. This port is commonly blocked by enterprise firewalls. The vulnerability has been exploited in the wild and is known to be used in ransomware campaigns.
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.
CVE-2021-29256 is a use-after-free vulnerability in the Arm Mali GPU Kernel Driver that may allow a non-privileged user to gain root privileges or disclose sensitive information. This vulnerability has been exploited in the wild, indicating active threat activity. No specific affected versions or patch information is provided in the available data.
CVE-2023-34192 is a critical Cross Site Scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) version 8.8.15. It allows a remote authenticated attacker to execute arbitrary code by injecting crafted scripts into the /h/autoSaveDraft function. The vulnerability requires the attacker to have valid user credentials and some user interaction to trigger the exploit. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected system. No public exploits are currently known in the wild, but the high CVSS score of 9 reflects the severe impact and ease of exploitation. European organizations using Zimbra ZCS 8.8.15, especially those in government, finance, and critical infrastructure sectors, are at significant risk.
The D-Link DIR-859 router has a command execution vulnerability in its UPnP service at the /gena.cgi endpoint. An unauthenticated remote attacker on the local network can exploit this flaw by sending a specially crafted HTTP SUBSCRIBE request, allowing execution of system commands with root privileges. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2019-20500 is an authenticated command injection vulnerability in the D-Link DWL-2600AP access point. It occurs via the Save Configuration functionality in the web interface, where shell metacharacters can be injected through the admin.cgi?action=config_save configBackup or downloadServerip parameters. This vulnerability has been exploited in the wild.
