Snapshot
July 15, 2023 - July 21, 2023
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2023-29298 | Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | HIGH | Adobe | July 20, 2023 |
| CVE-2023-38205 | Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. | N/A | Adobe | July 20, 2023 |
| CVE-2023-3519 | Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution. | CRITICAL | Citrix | July 19, 2023 |
| CVE-2023-36884 | Microsoft Office and Windows contain an unspecified vulnerability that allows an attacker to perform remote code execution via a specially crafted Microsoft Office document. | HIGH | Microsoft | July 17, 2023 |
Newswires |
||||
|
Atlassian Issues Security Advisories for Confluence and Bamboo Vulnerabilities
Atlassian has announced the presence of three vulnerabilities in its Confluence Data Center & Server and Bamboo Data Center & Server. |
July 21, 2023 |
|||
|
Critical Infrastructure Organization Breached via Exploited Citrix RCE Bug
The Cybersecurity and Infrastructure Security Agency (CISA) has reported that unidentified threat actors breached a US organization operating in the critical infrastructure sector. |
July 21, 2023 |
|||
|
Critical Vulnerabilities in AMI MegaRAC Could Allow Hackers to Sabotage Servers
Critical security vulnerabilities have been found in the MegaRAC Baseboard Management Controller (BMC) software, a product of American Megatrends International. |
July 20, 2023 |
|||
|
Adobe Rushes Out Emergency Patch for ColdFusion Zero-Day Exploited in Attacks
Adobe has issued an emergency security update for its ColdFusion software, addressing several critical vulnerabilities, one of which is a new zero-day that has been exploited in attacks. |
July 19, 2023 |
|||
|
Adobe Releases Urgent ColdFusion Security Update to Address Critical Zero-Day Exploits
Adobe has issued an emergency security update for its ColdFusion software, addressing several critical vulnerabilities, including a new zero-day exploit that has been used in attacks. |
July 19, 2023 |
|||
|
OpenSSH Addresses Remote Code Execution Vulnerability: CVE-2023-38408
On July 19, 2023, OpenSSH, the most commonly used implementation of the Secure Shell (SSH) protocol, issued an update to tackle the latest identified threat, CVE-2023-38408. |
July 19, 2023 |
|||
|
Recently Patched GE Cimplicity Vulnerabilities Echo Russian ICS Attacks
GE has recently patched over a dozen vulnerabilities in its Cimplicity HMI/SCADA product that bear striking similarities to industrial control system (ICS) attacks executed by the infamous Russian hacker group, Sandworm. |
July 19, 2023 |
|||
|
Urgent Warning Issued for Citrix Zero-Day Exploit: A Rise in Attacks Expected
Citrix has recently addressed several vulnerabilities, including a critical zero-day, CVE-2023-3519, that has been leveraged in attacks. |
July 19, 2023 |
|||
|
Critical Vulnerability in Citrix ADC and Gateway Exploited in Zero-Day Attacks
Citrix is warning customers of a critical vulnerability (CVE-2023-3519) in its NetScaler ADC and NetScaler Gateway products. |
July 18, 2023 |
|||
|
CISA Directs Government Agencies to Address Windows and Office Zero-Days
The Cybersecurity and Infrastructure Security Agency (CISA) has instructed federal agencies to address zero-day vulnerabilities impacting Windows and Office products. |
July 18, 2023 |
|||
|
Critical Vulnerability in WordPress WooCommerce Payments Plugin Exploited by Hackers
Hackers are extensively exploiting a significant vulnerability in the WooCommerce Payments plugin, a popular tool used on WordPress sites to accept credit and debit card payments. |
July 17, 2023 |
|||
|
Critical Vulnerability in ColdFusion Addressed as Adobe Releases Another Key Patch
Adobe has released patches for a critical vulnerability in its ColdFusion software that could be exploited to execute arbitrary code. |
July 17, 2023 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2023-3519 (17) | Unauthenticated remote code execution | CRITICAL | Citrix |
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
| CVE-2023-38203 (15) | Adobe ColdFusion versions 2018u17 , 2021u7 and 2023u1 are affected by a Deserialization of Untrusted Data vulnerability tha... | CRITICAL | Adobe | Risk Context N/A |
| CVE-2023-29300 (12) | Adobe ColdFusion versions 2018u16 , 2021u6 and 2023.0.0.330468 are affected by a Deserialization of Untrusted Data vulnerab... | CRITICAL | Adobe |
Actively Exploited |
| CVE-2023-28121 (8) | An issue in WooCommerce Payments plugin for WordPress allows an unauthenticated attacker to send requests on behalf of an el... | CRITICAL | Automattic |
Actively Exploited Remote Code Execution Public Exploits Available |
| CVE-2023-3466 (11) | Reflected Cross-Site Scripting | HIGH | Risk Context N/A | |
| CVE-2023-3467 (11) | Privilege Escalation to root administrator | HIGH | Risk Context N/A | |
| CVE-2023-29298 (14) | Adobe ColdFusion versions 2018u16 , 2021u6 and 2023.0.0.330468 are affected by an Improper Access Control vulnerability tha... | HIGH | Adobe |
CISA Known Exploited |
CISA Known Exploited Vulnerabilities
CISA added four vulnerabilities to the known exploited vulnerabilities list.
Adobe — ColdFusion |
|
CVE-2023-38205 / Added: July 20, 2023 |
|
CVSS Not Assigned |
|
Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass. |
|
Headlines
|
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2023-3519 |
|
CRITICAL CVSS 9.80 EPSS Score 2.22 EPSS Percentile 87.98 |
|
CISA Known Exploited Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: July 19, 2023 |
|
Unauthenticated remote code execution |
|
Vendor Impacted: Citrix |
|
Products Impacted: Netscaler Gateway, Netscaler Application Delivery Contr, Netscaler Adc And Netscaler Gateway |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-29300 |
|
CRITICAL CVSS 9.80 EPSS Score 2.28 EPSS Percentile 88.15 |
|
Actively Exploited |
|
Published: July 12, 2023 |
|
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. |
|
Vendor Impacted: Adobe |
|
Product Impacted: Coldfusion |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-28121 |
|
CRITICAL CVSS 9.80 EPSS Score 72.77 EPSS Percentile 97.65 |
|
Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: April 12, 2023 |
|
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated. |
|
Vendor Impacted: Automattic |
|
Product Impacted: Woocommerce Payments |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-29298 |
|
HIGH CVSS 7.50 EPSS Score 1.80 EPSS Percentile 86.49 |
|
CISA Known Exploited |
|
Published: July 12, 2023 |
|
Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction. |
|
Vendor Impacted: Adobe |
|
Product Impacted: Coldfusion |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
