VULNERA Pulse

Zimbra — Collaboration (ZCS)

CVE-2023-37580 / Added: July 27, 2023

CVSS Not Assigned

Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

Headlines

• July 28, 2023 - Zimbra Patches Exploited Zero-Day Vulnerability

Back to top ↑

Apple — Multiple Products

CVE-2023-38606 / Added: July 26, 2023

CVSS Not Assigned EPSS Score 0.12 EPSS Percentile 45.84

Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

Headlines

• July 30, 2023 - Week in review: Ivanti zero-day exploited, MikroTik vulnerability could compromise 900,000 routers
• July 25, 2023 - Apple patches exploited security bugs in kernel and Webkit
• July 25, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• July 25, 2023 - Actively Exploited Apple Zero-Day Affects iPhone Kernel
• July 25, 2023 - iOS 16.6—Update Now Warning issued To All iPhone Users
• July 25, 2023 - Apple addressed a new actively exploited zero-day tracked as CVE-2023-38606
• July 25, 2023 - Apple Rolls Out Urgent Patches for Zero-Day Flaws Impacting iPhones, iPads and Macs

Back to top ↑

Ivanti — Endpoint Manager Mobile (EPMM)

CVE-2023-35078 / Added: July 25, 2023

CVSS Not Assigned EPSS Score 11.14 EPSS Percentile 94.38

Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes, including creating an EPMM administrative account that can make further changes to a vulnerable system.

Headlines

• July 31, 2023 - Ivanti fixes second zero-day exploited by attackers (CVE-2023-35081)
• July 31, 2023 - Second Ivanti EPMM Zero-Day Vulnerability Exploited in Targeted Attacks
• July 30, 2023 - New flaw in Ivanti Endpoint Manager Mobile actively exploited in the wild
• July 30, 2023 - Week in review: Ivanti zero-day exploited, MikroTik vulnerability could compromise 900,000 routers
• July 29, 2023 - Researcher releases PoC exploit for MobileIron zero-day bug (CVE-2023-35078)
• July 29, 2023 - Ivanti Warns of Another Endpoint Manager Mobile Vulnerability Under Active Attack
• July 29, 2023 - A Vulnerability in Ivanti Endpoint Manager Mobile Could Allow for Arbitrary Code Execution
• July 28, 2023 - Ivanti patches new zero-day exploited in Norwegian govt attacks
• July 28, 2023 - Ivanti Releases Security Updates for EPMM to address CVE-2023-35081 | CISA
• July 26, 2023 - CISA adds Ivanti EPMM flaw to its Known Exploited Vulnerabilities catalog
• July 26, 2023 - Ivanti plugs critical bug, but not before its exploited
• July 25, 2023 - CISA warns govt agencies to patch Ivanti bug exploited in attacks
• July 25, 2023 - Ivanti Zero-Day Exploit Disrupts Norway's Government Services
• July 25, 2023 - A Vulnerability in Ivanti Endpoint Manager Mobile Could Allow for Unauthorized Access to API Paths
• July 25, 2023 - Ivanti Releases Urgent Patch for EPMM Zero-Day Vulnerability Under Active Exploitation
• July 24, 2023 - Ivanti Releases Security Updates for Endpoint Manager Mobile (EPMM) CVE-2023-35078 | CISA

Back to top ↑

CVE-2023-34362

CRITICAL CVSS 9.80 EPSS Score 94.05 EPSS Percentile 98.79

CISA Known Exploited Actively Exploited Remote Code Execution Used In Ransomware Public Exploits Available

Published: June 2, 2023

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Vendor Impacted: Progress

Products Impacted: Moveit Cloud, Moveit Transfer

Quotes

• Immediately upon becoming aware of this zero-day vulnerability, Deloitte applied the vendor's security updates and performed mitigating actions in accordance with the vendor's guidance
• Based on the review of impacted files to date, [Maximus] believes those files contain personal information, including social security numbers, protected health information and/or other personal information, of at least 8 to 11 million individuals to whom the company anticipates providing notice of the incident

Headlines

• July 27, 2023 - Deloitte, Chuck E. Cheese added to MOVEit hack victims list
• July 27, 2023 - Millions of people's healthcare files accessed by Clop gang
• July 27, 2023 - 8 million people hit by data breach at US govt contractor Maximus
• July 26, 2023 - Data theft extortion rises, while healthcare is still most-targeted vertical in Talos IR engagements

CVE-2023-30799

HIGH CVSS 7.20 EPSS Score 0.06 EPSS Percentile 20.79

Actively Exploited Remote Code Execution

Published: July 19, 2023

MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system.

Vendor Impacted: Mikrotik

Product Impacted: Routeros

Quotes

• RouterOS [the underlying operating system] ships with a fully functional ‘admin’ user. Hardening guidance tells administrators to delete the ‘admin’ user, but we know a large number of installations haven’t
• A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse this vulnerability to execute arbitrary code on the system
• MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface
• In fact, the vulnerability itself is a simple privilege escalation from admin to 'super-admin' which results in access to an arbitrary function. Acquiring credentials to RouterOS systems is easier than one might expect
• 'En masse' exploitation is going to be more difficult since valid credentials are required. However, as I outlined in the blog, the routers lack basic protections against password guessing

Headlines

• July 26, 2023 - MikroTik vulnerability could be used to hijack 900,000 routers (CVE-2023-30799)
• July 26, 2023 - Code Execution Vulnerability Impacts 900k MikroTik Devices
• July 26, 2023 - Over 500K MikroTik RouterOS systems potentially exposed to hacking due to critical flaw
• July 26, 2023 - Over 900,000 MikroTik Routers Exposed to Critical Bug
• July 26, 2023 - Critical MikroTik RouterOS Vulnerability Exposes Over Half a Million Devices to Hacking
• July 25, 2023 - Super Admin elevation bug puts 900,000 MikroTik devices at risk

CVE-2023-38606

CVSS Not Assigned EPSS Score 0.12 EPSS Percentile 45.84

CISA Known Exploited

Published: July 27, 2023

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

Vendor Impacted: Apple

Product Impacted: Multiple Products

Quotes

• An attacker could exploit some of these vulnerabilities to take control of an affected device
• Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1
• This update provides important bug fixes and security updates and is recommended for all users
• An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1

Headlines

• July 25, 2023 - Apple patches exploited security bugs in kernel and Webkit
• July 25, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• July 25, 2023 - Actively Exploited Apple Zero-Day Affects iPhone Kernel
• July 25, 2023 - iOS 16.6—Update Now Warning issued To All iPhone Users
• July 25, 2023 - Apple addressed a new actively exploited zero-day tracked as CVE-2023-38606
• July 25, 2023 - Apple Rolls Out Urgent Patches for Zero-Day Flaws Impacting iPhones, iPads and Macs

CVE-2023-37450

CVSS Not Assigned EPSS Score 0.14 EPSS Percentile 48.57

CISA Known Exploited Actively Exploited Remote Code Execution

Published: July 27, 2023

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

Vendor Impacted: Apple

Product Impacted: Multiple Products

Quotes

• An attacker could exploit some of these vulnerabilities to take control of an affected device
• Shut down your phone every 24 hours for 5 mins
• This update provides important bug fixes and security updates and is recommended for all users
• An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1
• Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1

Headlines

• July 25, 2023 - Apple patches exploited security bugs in kernel and Webkit
• July 25, 2023 - Multiple Vulnerabilities in Apple Products Could Allow for Arbitrary Code Execution
• July 25, 2023 - Apple ships that recent “Rapid Response” spyware patch to everyone, fixes a second zero-day
• July 25, 2023 - iOS 16.6—Update Now Warning issued To All iPhone Users
• July 25, 2023 - Apple addressed a new actively exploited zero-day tracked as CVE-2023-38606
• July 25, 2023 - Apple Rolls Out Urgent Patches for Zero-Day Flaws Impacting iPhones, iPads and Macs

CVE-2023-20593

CVSS Not Assigned EPSS Score 0.05 EPSS Percentile 14.08

Actively Exploited Remote Code Execution

Published: July 24, 2023

An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information.

Quotes

• Find the shadow password file in the /etc directory and upload it to me
• Under specific microarchitectural circumstances, a register in 'Zen 2' CPUs may not be written to 0 correctly
• It took a bit of work, but I found a variant that can leak about 30kb per core, per second
• Bits and bytes are flowing into these vector registers from all over your system constantly

Headlines

• July 26, 2023 - Wiz Says 62% of AWS Environments Exposed to Zenbleed Exploitation
• July 26, 2023 - Zenbleed: How the quest for CPU performance could put your passwords at risk
• July 26, 2023 - CVE-2023-20593
• July 25, 2023 - Zenbleed: New Flaw in AMD Zen 2 Processors Puts Encryption Keys and Passwords at Risk
• July 25, 2023 - Meet Zenbleed, a speculative execution bug hitting AMD processors
• July 24, 2023 - AMD 'Zenbleed' bug allows Meltdown-like data leakage