Snapshot
April 15, 2023 - April 21, 2023
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2023-27350 | PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. | CRITICAL | PaperCut | April 21, 2023 |
| CVE-2023-28432 | MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure. | HIGH | MinIO | April 21, 2023 |
| CVE-2023-2136 | Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. | N/A | April 21, 2023 | |
| CVE-2017-6742 | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE contains a vulnerability that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. | HIGH | Cisco | April 19, 2023 |
| CVE-2023-2033 | Google Chromium V8 contains a type confusion vulnerability. Specific impacts from exploitation are not available at this time. | HIGH | April 17, 2023 | |
| CVE-2019-8526 | Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. | HIGH | Apple | April 17, 2023 |
Newswires |
||||
|
Cisco Patches Critical Vulnerabilities in Industrial Network Director and Modeling Labs Solutions
Cisco has recently issued security updates to address critical vulnerabilities in its Industrial Network Director and Modeling Labs solutions. |
April 21, 2023 |
|||
|
VMware Addresses Critical Security Flaws in Logging Product
VMware, a virtualization technology giant, is facing significant security issues in its enterprise-facing log analysis product. |
April 20, 2023 |
|||
|
PaperCut Alerts Users of Exploited Vulnerability in Print Management Systems
Print management solutions provider PaperCut has issued a warning to organizations about the exploitation of a recently patched critical-severity vulnerability in their print management system, PaperCut MF/NG. |
April 20, 2023 |
|||
|
Fortra Investigates GoAnywhere MFT Zero-Day Exploits by Clop Ransomware Gang
Fortra has concluded its investigation into the exploitation of CVE-2023-0669, a zero-day vulnerability in the GoAnywhere MFT solution, which the Clop ransomware gang used to steal data from over a hundred companies. |
April 19, 2023 |
|||
|
Google Releases Security Update for Actively Exploited Chrome Zero-Day
Google has released a security update for its Chrome web browser to address the second zero-day vulnerability discovered to be exploited in attacks this year. |
April 19, 2023 |
|||
|
Microsoft Warns of Iranian Hackers Targeting US Critical Infrastructure
Microsoft has issued a warning about a subgroup of Iran-linked advanced persistent threat (APT) actor Mint Sandstorm, which has started to quickly adopt proof-of-concept (PoC) exploit code targeting vulnerabilities in internet-facing applications. |
April 19, 2023 |
|||
|
Russian APT28 Exploits Old Vulnerability to Target Cisco Routers
US and UK government agencies have issued a joint cybersecurity advisory warning organizations about attacks in which Russian threat group APT28 has exploited an old vulnerability to hack Cisco routers. |
April 19, 2023 |
|||
|
APT41 Adopts Google Red Teaming Tool for Cyber Espionage
The advanced persistent threat (APT) group known as APT41 has employed an open-source, red-teaming tool, Google Command and Control (GC2), in cyber espionage attacks, marking a shift in its tactics. |
April 18, 2023 |
|||
|
NSO Group Utilizes Three iOS Zero-Click Exploits in 2022: Citizen Lab Report
According to a recent report from Citizen Lab, Israeli spyware vendor NSO Group used at least three previously unknown iOS zero-click exploits in 2022. |
April 18, 2023 |
|||
|
Ransomware Attack Targets US Payments Giant NCR
US payments giant NCR has confirmed that it was targeted in a ransomware attack, with the BlackCat/Alphv group taking credit for the incident. |
April 17, 2023 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2022-36067 (2) | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. | CRITICAL |
Actively Exploited Remote Code Execution Public Exploits Available |
|
| CVE-2023-2033 (12) | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruptio... | HIGH |
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
| CVE-2017-6742 (11) | The Simple Network Management Protocol subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through... | HIGH | Cisco |
CISA Known Exploited Actively Exploited Remote Code Execution |
| CVE-2023-20963 (3) | In WorkSource, there is a possible parcel mismatch. | HIGH | Google, Android |
CISA Known Exploited Actively Exploited Remote Code Execution |
| CVE-2023-0669 (6) | Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due ... | HIGH | Fortra |
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
| CVE-2023-2136 (7) | Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer ... | N/A |
CISA Known Exploited Remote Code Execution |
|
| CVE-2023-20864 (5) | VMware Aria Operations for Logs contains a deserialization vulnerability. | N/A |
Remote Code Execution |
|
| CVE-2023-20865 (4) | VMware Aria Operations for Logs contains a command injection vulnerability. | N/A | Risk Context N/A | |
CISA Known Exploited Vulnerabilities
CISA added six vulnerabilities to the known exploited vulnerabilities list.
PaperCut — MF/NG |
|
CVE-2023-27350 / Added: April 21, 2023 |
|
CRITICAL CVSS 9.80 |
|
PaperCut MF/NG contains an improper access control vulnerability within the SetupCompleted class that allows authentication bypass and code execution in the context of system. |
|
Headlines |
MinIO — MinIO |
|
CVE-2023-28432 / Added: April 21, 2023 |
|
HIGH CVSS 7.50 |
|
MinIO contains a vulnerability in a cluster deployment where MinIO returns all environment variables, which allows for information disclosure. |
|
Headlines |
Google — Chrome |
|
CVE-2023-2136 / Added: April 21, 2023 |
|
CVSS Not Assigned |
|
Google Chrome Skia contains an integer overflow vulnerability. Specific impacts from exploitation are not available at this time. This vulnerability resides in Skia which serves as the graphics engine for Google Chrome and ChromeOS, Android, Flutter, and other products. |
|
Headlines
|
Apple — macOS |
|
CVE-2019-8526 / Added: April 17, 2023 |
|
HIGH CVSS 7.80 |
|
Apple macOS contains a use-after-free vulnerability that could allow for privilege escalation. |
|
Headlines |
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2022-36067 |
|
CRITICAL CVSS 10.00 |
|
Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: Sept. 6, 2022 |
|
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds. |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
CVE-2023-2033 |
|
HIGH CVSS 8.80 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: April 14, 2023 |
|
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
|
Vendor Impacted: Google |
|
Product Impacted: Chromium V8 Engine |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2017-6742 |
|
HIGH CVSS 8.80 |
|
CISA Known Exploited Actively Exploited Remote Code Execution |
|
Published: July 17, 2017 |
|
The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS 12.0 through 12.4 and 15.0 through 15.6 and IOS XE 2.2 through 3.17 contains multiple vulnerabilities that could allow an authenticated, remote attacker to remotely execute code on an affected system or cause an affected system to reload. An attacker could exploit these vulnerabilities by sending a crafted SNMP packet to an affected system via IPv4 or IPv6. Only traffic directed to an affected system can be used to exploit these vulnerabilities. The vulnerabilities are due to a buffer overflow condition in the SNMP subsystem of the affected software. The vulnerabilities affect all versions of SNMP: Versions 1, 2c, and 3. To exploit these vulnerabilities via SNMP Version 2c or earlier, the attacker must know the SNMP read-only community string for the affected system. To exploit these vulnerabilities via SNMP Version 3, the attacker must have user credentials for the affected system. All devices that have enabled SNMP and have not explicitly excluded the affected MIBs or OIDs should be considered vulnerable. Cisco Bug IDs: CSCve54313. |
|
Vendor Impacted: Cisco |
|
Products Impacted: Ios And Ios Xe Software, Ios Xe |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-20963 |
|
HIGH CVSS 7.80 |
|
CISA Known Exploited Actively Exploited Remote Code Execution |
|
Published: March 24, 2023 |
|
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519 |
|
Vendors Impacted: Google, Android |
|
Products Impacted: Android, Framework |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
CVE-2023-0669 |
|
HIGH CVSS 7.20 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available |
|
Published: Feb. 6, 2023 |
|
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2. |
|
Vendor Impacted: Fortra |
|
Products Impacted: Goanywhere Mft, Goanywhere Managed File Transfer |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-2136 |
|
CVSS Not Assigned |
|
CISA Known Exploited Remote Code Execution |
|
Published: April 19, 2023 |
|
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
|
Vendor Impacted: Google |
|
Product Impacted: Chrome |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-20864 |
|
CVSS Not Assigned |
|
Remote Code Execution |
|
Published: April 20, 2023 |
|
VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for Logs may be able to execute arbitrary code as root. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-20865 |
|
CVSS Not Assigned |
|
Risk Context N/A |
|
Published: April 20, 2023 |
|
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
