VULNERA Pulse

Red Hat — JBoss RichFaces Framework

CVE-2018-14667 / Added: Sept. 28, 2023

CRITICAL CVSS 9.80 EPSS Score 87.23 EPSS Percentile 98.24

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

Headlines

• Sept. 29, 2023 - CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
• Sept. 29, 2023 - CISA adds JBoss RichFaces Framework flaw to its Known Exploited Vulnerabilities catalog
• Sept. 29, 2023 - CISA warns of critical Red Hat JBoss RichFaces Framework RCE flaw exploited in attacks

Back to top ↑

Apple — Multiple Products

CVE-2023-41993 / Added: Sept. 25, 2023

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 36.41

Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that can allow an attacker to execute code when processing web content.

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 27, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 27, 2023 - macOS 14 Sonoma Patches 60 Vulnerabilities
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway
• Sept. 23, 2023 - Apple and Chrome Zero-Days Exploited to Hack Egyptian ex-MP with Predator Spyware
• Sept. 22, 2023 - Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware
• Sept. 22, 2023 - Apple squashes bugs exploited by Predator spyware
• Sept. 22, 2023 - Recently patched Apple, Chrome zero-days exploited in spyware attacks
• Sept. 22, 2023 - Apple Fixes 3 More Zero-Day Vulnerabilities
• Sept. 22, 2023 - Apple fixes 3 zero-day vulnerabilities exploited to compromise iPhones
• Sept. 22, 2023 - Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
• Sept. 22, 2023 - Apple Patches Three Actively Exploited Zero-Days
• Sept. 22, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 21, 2023 - Apple rolled out emergency updates to address 3 new actively exploited zero-day flaws
• Sept. 21, 2023 - iOS 17.0.1: Critical Security Update Warning For All iPhone Users

Back to top ↑

Apple — Multiple Products

CVE-2023-41992 / Added: Sept. 25, 2023

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 24.77

Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 27, 2023 - iOS 17.0.2 Vs iOS 16.7—Here’s Which iPhone Update To Choose
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway
• Sept. 23, 2023 - Apple and Chrome Zero-Days Exploited to Hack Egyptian ex-MP with Predator Spyware
• Sept. 22, 2023 - Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware
• Sept. 22, 2023 - Apple squashes bugs exploited by Predator spyware
• Sept. 22, 2023 - Recently patched Apple, Chrome zero-days exploited in spyware attacks
• Sept. 22, 2023 - Apple Fixes 3 More Zero-Day Vulnerabilities
• Sept. 22, 2023 - Apple fixes 3 zero-day vulnerabilities exploited to compromise iPhones
• Sept. 22, 2023 - Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
• Sept. 22, 2023 - Apple Patches Three Actively Exploited Zero-Days
• Sept. 22, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 21, 2023 - Apple rolled out emergency updates to address 3 new actively exploited zero-day flaws
• Sept. 21, 2023 - iOS 17.0.1: Critical Security Update Warning For All iPhone Users

Back to top ↑

Apple — Multiple Products

CVE-2023-41991 / Added: Sept. 25, 2023

MEDIUM CVSS 5.50 EPSS Score 2.02 EPSS Percentile 87.56

Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway
• Sept. 23, 2023 - Apple and Chrome Zero-Days Exploited to Hack Egyptian ex-MP with Predator Spyware
• Sept. 22, 2023 - Recently patched Apple and Chrome zero-days exploited to infect devices in Egypt with Predator spyware
• Sept. 22, 2023 - Apple squashes bugs exploited by Predator spyware
• Sept. 22, 2023 - Recently patched Apple, Chrome zero-days exploited in spyware attacks
• Sept. 22, 2023 - Apple Fixes 3 More Zero-Day Vulnerabilities
• Sept. 22, 2023 - Apple fixes 3 zero-day vulnerabilities exploited to compromise iPhones
• Sept. 22, 2023 - Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
• Sept. 22, 2023 - Apple Patches Three Actively Exploited Zero-Days
• Sept. 22, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 21, 2023 - Apple rolled out emergency updates to address 3 new actively exploited zero-day flaws
• Sept. 21, 2023 - iOS 17.0.1: Critical Security Update Warning For All iPhone Users

Back to top ↑

CVE-2023-41993

CRITICAL CVSS 9.80 EPSS Score 0.09 EPSS Percentile 36.41

CISA Known Exploited

Published: Sept. 21, 2023

The issue was addressed with improved checks. This issue is fixed in Safari 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Vendor Impacted: Apple

Products Impacted: Multiple Products, Safari, Iphone Os, Ipad Os

Quotes

• Against versions of iOS before iOS 16.7
• Persistently selected for targeting via network injection
• Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7
• The use of MITM injection gives the attacker a capability where they don't have to rely on the user to take a typical action like clicking a specific link, opening a document, etc
• While there’s a spotlight on ‘0-click’ vulnerabilities (bugs that don’t require user interaction) this MITM delivery also didn’t require the user to open any documents, click a specific link, or answer any phone calls

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 27, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• Sept. 27, 2023 - macOS 14 Sonoma Patches 60 Vulnerabilities
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway

CVE-2023-34362

CRITICAL CVSS 9.80 EPSS Score 92.01 EPSS Percentile 98.59

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: June 2, 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Vendor Impacted: Progress

Products Impacted: Moveit Transfer, Moveit Cloud

Quotes

• Related to pregnancy, birth and newborn care
• Pregnancy, birth, the newborn period and childhood to improve care
• At this time, there is no evidence that any of the copied data has been misused for any fraudulent purposes
• Through our investigation, on June 20, 2023, we learned that an unauthorized party obtained certain files from the MOVEit tool
• The most heavily impacted sectors are finance and professional services and education, which account for 13.8 percent and 51.1 percent of incidents respectively
• BORN (the Better Outcomes Registry & Network) was impacted by a cybersecurity breach caused by a global vulnerability of the software we use, Progress MOVEit, to perform secure file transfers. During the breach, unauthorized copies of files containing personal health information were taken from BORN’s systems
• On May 31, 2023, the Clearinghouse was informed by our third-party software provider, Progress Software, of a cybersecurity issue involving the provider’s MOVEit Transfer solution. MOVEit Transfer is a file transfer tool used by many organizations, including the Clearinghouse, to support the transfer of data files

Headlines

• Sept. 29, 2023 - Over 2,000 organizations are impacted by the MOVEit hack
• Sept. 26, 2023 - Ontario perinatal and child registry BORN breached
• Sept. 26, 2023 - Cl0p's MOVEit attack tally surpasses 2,000 victim organizations
• Sept. 26, 2023 - BORN Ontario data breach impacted 3.4 million newborns and pregnancy care patients
• Sept. 26, 2023 - SickKids impacted by BORN Ontario data breach that hit 3.4 million
• Sept. 25, 2023 - BORN Ontario child registry data breach affects 3.4 million people
• Sept. 25, 2023 - National Student Clearinghouse MOVEit breach impacts nearly 900 schools
• Sept. 24, 2023 - National Student Clearinghouse data breach impacted approximately 900 US schools

CVE-2023-4863

HIGH CVSS 8.80 EPSS Score 38.99 EPSS Percentile 96.78

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 12, 2023

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

Vendors Impacted: Debian, Google, Mozilla, Fedoraproject

Products Impacted: Debian Linux, Fedora, Firefox Esr, Thunderbird, Chromium Webp, Firefox

Quotes

• Fix OOB write in BuildHuffmanTable
• Heap buffer overflow in vp8 encoding in libvpx
• An opportunity to appeal a verification decision and for X to review your appeal
• This package stands out for its efficiency, outperforming JPEG and PNG in terms of size and speed
• Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed
• With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use

Headlines

• Sept. 28, 2023 - Chrome Flags Third Zero-Day This Month That's Tied to Spying Exploits
• Sept. 28, 2023 - Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863)
• Sept. 28, 2023 - The security pitfalls of social media sites offering ID-based authentication
• Sept. 28, 2023 - Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)
• Sept. 28, 2023 - Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
• Sept. 28, 2023 - Update Chrome Now: Google Releases Patch for Actively Exploited Zero-Day Vulnerability
• Sept. 27, 2023 - Google fixes fifth actively exploited Chrome zero-day of 2023
• Sept. 27, 2023 - Watch out! CVE-2023-5129 in libwebp library affects millions apps
• Sept. 27, 2023 - Google "confirms" that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)
• Sept. 27, 2023 - Critical libwebp Vulnerability Under Active Exploitation - Gets Maximum CVSS Score
• Sept. 27, 2023 - CVE-2023-5129: Critical Heap Buffer Overflow Bug in libwebp Library Affects Major Browsers
• Sept. 26, 2023 - Google assigns new maximum rated CVE to libwebp bug exploited in attacks

CVE-2023-5217

HIGH CVSS 8.80 EPSS Score 0.15 EPSS Percentile 51.06

Actively Exploited Remote Code Execution

Published: Sept. 28, 2023

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Vendors Impacted: Mozilla, Google, Webmproject

Products Impacted: Firefox Esr, Firefox Focus, Chrome, Libvpx, Firefox

Quotes

• Aware that an exploit for CVE-2023-5217 exists in the wild
• Google is aware that an exploit for CVE-2023-5217 exists in the wild
• High CVE-2023-5217: Heap buffer overflow in vp8 encoding in libvpx. Reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-09-25″ reads the advisory published by Google
• Specific handling of an attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild
• Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed

Headlines

• Sept. 29, 2023 - Mozilla Releases Emergency Security Updates to Fix Critical Zero-Day Vulnerability Exploited in the Wild
• Sept. 28, 2023 - Chrome Flags Third Zero-Day This Month That's Tied to Spying Exploits
• Sept. 28, 2023 - Multiple Vulnerabilities in Google Chrome Could Allow for Arbitrary Code Execution
• Sept. 28, 2023 - Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)
• Sept. 28, 2023 - Google Rushes to Patch New Zero-Day Exploited by Spyware Vendor
• Sept. 28, 2023 - GOOGLE FIXED THE FIFTH CHROME ZERO-DAY OF 2023
• Sept. 28, 2023 - Google Patches Chrome Zero-Day Used in Spyware Attacks
• Sept. 28, 2023 - Update Chrome Now: Google Releases Patch for Actively Exploited Zero-Day Vulnerability
• Sept. 28, 2023 - CVE-2023-5217: Chrome zero-day vulnerability exploited in attacks
• Sept. 27, 2023 - Google fixes fifth actively exploited Chrome zero-day of 2023

CVE-2023-5129

HIGH CVSS 8.80 EPSS Score 0.04 EPSS Percentile 12.50

Risk Context N/A

Published: Sept. 25, 2023

** REJECT ** This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate of CVE-2023-4863.

Quotes

• Fix OOB write in BuildHuffmanTable
• An opportunity to appeal a verification decision and for X to review your appeal
• This package stands out for its efficiency, outperforming JPEG and PNG in terms of size and speed
• Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed
• With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use

Headlines

• Sept. 28, 2023 - Critical Vulnerability: WebP Heap Buffer Overflow (CVE-2023-4863)
• Sept. 28, 2023 - The security pitfalls of social media sites offering ID-based authentication
• Sept. 28, 2023 - Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)
• Sept. 28, 2023 - Update Chrome Now: Google Releases Patch for Actively Exploited Zero-Day Vulnerability
• Sept. 27, 2023 - Google fixes fifth actively exploited Chrome zero-day of 2023
• Sept. 27, 2023 - Watch out! CVE-2023-5129 in libwebp library affects millions apps
• Sept. 27, 2023 - Google "confirms" that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)
• Sept. 27, 2023 - Critical libwebp Vulnerability Under Active Exploitation - Gets Maximum CVSS Score
• Sept. 27, 2023 - CVE-2023-5129: Critical Heap Buffer Overflow Bug in libwebp Library Affects Major Browsers
• Sept. 26, 2023 - Google assigns new maximum rated CVE to libwebp bug exploited in attacks

CVE-2023-40044

HIGH CVSS 8.80 EPSS Score 0.05 EPSS Percentile 18.37

Risk Context N/A

Published: Sept. 27, 2023

In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.  

Quotes

• Predictable, simple and transparent process for product and security fixes
• Upgrading to a patched release, using the full installer, is the only way to remediate this issue
• Attackers could also escape the context of the WS_FTP Server file structure and perform the same level of operations (delete, rename, rmdir, mkdir) on file and folder locations on the underlying operating system
• In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system

Headlines

• Sept. 29, 2023 - Move Over, MOVEit: Critical Progress Bug Infests WS_FTP Software
• Sept. 29, 2023 - MOVEit Developer Patches Critical File Transfer Bug
• Sept. 29, 2023 - Progress Software Releases Urgent Hotfixes for Multiple Security Flaws in WS_FTP Server
• Sept. 28, 2023 - Progress warns of maximum severity WS_FTP Server vulnerability
• Sept. 28, 2023 - Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
• Sept. 27, 2023 - Progress WS_FTP Server Security Vulnerabilities: What You Need to Know

CVE-2023-41992

HIGH CVSS 7.80 EPSS Score 0.06 EPSS Percentile 24.77

CISA Known Exploited Actively Exploited

Published: Sept. 21, 2023

The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A local attacker may be able to elevate their privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Vendor Impacted: Apple

Products Impacted: Watchos, Macos, Multiple Products, Ipad Os, Iphone Os

Quotes

• Against versions of iOS before iOS 16.7
• Persistently selected for targeting via network injection
• Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7
• We believe and Apple's Security Engineering & Architecture Team confirms, Lockdown Mode would have blocked this attack
• The use of MITM injection gives the attacker a capability where they don't have to rely on the user to take a typical action like clicking a specific link, opening a document, etc
• While there’s a spotlight on ‘0-click’ vulnerabilities (bugs that don’t require user interaction) this MITM delivery also didn’t require the user to open any documents, click a specific link, or answer any phone calls

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 27, 2023 - iOS 17.0.2 Vs iOS 16.7—Here’s Which iPhone Update To Choose
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway

CVE-2023-41064

HIGH CVSS 7.80 EPSS Score 0.33 EPSS Percentile 67.58

CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available

Published: Sept. 7, 2023

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura 13.5.2, iOS 15.7.9 and iPadOS 15.7.9, macOS Big Sur 11.7.10. Processing a maliciously crafted image may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Products Impacted: Ipados, Ios, Ipados, And Macos, Iphone Os, Macos

Quotes

• This package stands out for its efficiency, outperforming JPEG and PNG in terms of size and speed
• Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed
• With a specially crafted WebP lossless file, libwebp may write data out of bounds to the heap. The ReadHuffmanCodes() function allocates the HuffmanCode buffer with a size that comes from an array of precomputed sizes: kTableSize. The color_cache_bits value defines which size to use

Headlines

• Sept. 28, 2023 - Chrome Flags Third Zero-Day This Month That's Tied to Spying Exploits
• Sept. 28, 2023 - Yet another Chrome zero-day exploited in the wild! (CVE-2023-5217)
• Sept. 27, 2023 - Watch out! CVE-2023-5129 in libwebp library affects millions apps
• Sept. 27, 2023 - Google "confirms" that exploited Chrome zero-day is actually in libwebp (CVE-2023-5129)
• Sept. 27, 2023 - Critical libwebp Vulnerability Under Active Exploitation - Gets Maximum CVSS Score
• Sept. 26, 2023 - Google assigns new maximum rated CVE to libwebp bug exploited in attacks

CVE-2023-20109

MEDIUM CVSS 6.60 EPSS Score 0.04 EPSS Percentile 12.69

Actively Exploited Remote Code Execution

Published: Sept. 27, 2023

A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash. This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker. A successful exploit could allow the attacker to execute arbitrary code and gain full control of the affected system or cause the affected system to reload, resulting in a denial of service (DoS) condition. For more information, see the Details ["#details"] section of this advisory.

Quotes

• Cisco has released software updates to address these vulnerabilities. Please refer to the specific security advisory for additional detail
• Cisco discovered attempted exploitation of the GET VPN feature and conducted a technical code review of the feature. This vulnerability was discovered during our internal investigation
• Could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash
• A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute arbitrary code on an affected device or cause the device to crash
• This vulnerability is due to insufficient validation of attributes in the Group Domain of Interpretation (GDOI) and G-IKEv2 protocols of the GET VPN feature. An attacker could exploit this vulnerability by either compromising an installed key server or modifying the configuration of a group member to point to a key server that is controlled by the attacker

Headlines

• Sept. 29, 2023 - Cisco Warns of Vulnerability in IOS and IOS XE Software After Exploitation Attempts
• Sept. 28, 2023 - New Cisco IOS Zero-Day Delivers a Double Punch
• Sept. 28, 2023 - Cisco urges to patch actively exploited IOS 0-day CVE-2023-20109
• Sept. 28, 2023 - Cisco urges admins to fix IOS software zero-day exploited in attacks
• Sept. 28, 2023 - Cisco Warns of IOS Software Zero-Day Exploitation Attempts
• Sept. 28, 2023 - Zero-Day Alert: CVE-2023-20109 - Cisco GET VPN Out-of-Bounds Write Vulnerability

CVE-2023-41991

MEDIUM CVSS 5.50 EPSS Score 2.02 EPSS Percentile 87.56

CISA Known Exploited

Published: Sept. 21, 2023

A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass signature validation. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

Vendor Impacted: Apple

Products Impacted: Watchos, Macos, Multiple Products, Ipad Os, Iphone Os

Quotes

• Against versions of iOS before iOS 16.7
• Persistently selected for targeting via network injection
• Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7
• The use of MITM injection gives the attacker a capability where they don't have to rely on the user to take a typical action like clicking a specific link, opening a document, etc
• While there’s a spotlight on ‘0-click’ vulnerabilities (bugs that don’t require user interaction) this MITM delivery also didn’t require the user to open any documents, click a specific link, or answer any phone calls

Headlines

• Sept. 29, 2023 - Spyware Vendor Targets Egyptian Orgs With Rare iOS Exploit Chain
• Sept. 26, 2023 - CISA warns of Apple's three zero-days exploited in spyware attacks
• Sept. 25, 2023 - Predator Spyware Delivered to iOS, Android Devices via Zero-Days, MitM Attacks
• Sept. 25, 2023 - Predator exploit patched in iPhones, iPads
• Sept. 24, 2023 - Week in review: 18 free Microsoft Azure cybersecurity resources, K8 vulnerability allows RCE
• Sept. 23, 2023 - New Critical Security Warning For iPhone, iPad, Watch, Mac—Attacks Underway