Snapshot
May 20, 2023 - May 26, 2023
CISA Known Exploited Vulnerabilities |
||||
|---|---|---|---|---|
| CVE | Summary | Severity | Vendor | Date Added |
| CVE-2023-2868 | Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. | CRITICAL | Barracuda Networks | May 26, 2023 |
| CVE-2023-28204 | Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information. | N/A | Apple | May 22, 2023 |
| CVE-2023-32373 | Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution. | N/A | Apple | May 22, 2023 |
| CVE-2023-32409 | Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. | N/A | Apple | May 22, 2023 |
Newswires |
||||
|
Buhti Ransomware Operation Expands, Targeting Global Organizations
A newly discovered ransomware operation named Buhti, also referred to as Blacktail by Symantec, has been rapidly expanding since mid-April 2023. |
May 26, 2023 |
|||
|
Mirai Botnet Exploits Zyxel Firewall Vulnerability
A Mirai botnet variant has been taking advantage of a recently patched vulnerability, identified as CVE-2023-28771, to compromise numerous Zyxel firewalls. |
May 26, 2023 |
|||
|
China-Backed Cyber Campaign 'Volt Typhoon' Targets Critical Infrastructure
The 'Volt Typhoon' cyber campaign, which is suspected to be backed by China, has been targeting critical infrastructure organizations in Guam, bringing to light the possibility of America's geopolitical adversaries launching disruptive cyberattacks against key communications and operational technologies. |
May 25, 2023 |
|||
|
D-Link Addresses Critical Authentication Bypass and RCE Vulnerabilities in D-View 8 Software
D-Link has recently patched two critical-severity vulnerabilities in its D-View 8 network management suite, which could have allowed remote attackers to bypass authentication and execute arbitrary code. |
May 25, 2023 |
|||
|
Critical Vulnerability Patched in GitLab CE/EE Version 16.0.1
GitLab, an open-source end-to-end software development platform, has released a security update to fix a critical-severity vulnerability affecting both GitLab Community Edition (CE) and Enterprise Edition (EE). |
May 25, 2023 |
|||
|
Buhti Ransomware Gang Targets Windows and Linux Systems with Leaked Encryptors
A new ransomware operation called 'Buhti' has surfaced, targeting Windows and Linux systems using the leaked code from the LockBit and Babuk ransomware families. |
May 25, 2023 |
|||
|
Barracuda ESG Appliances Breached Through Zero-Day Vulnerability
Barracuda Networks, a provider of network security solutions, recently alerted customers to a breach in some of its Email Security Gateway (ESG) appliances. |
May 24, 2023 |
|||
|
OAuth Vulnerability in Expo Platform Impacts Numerous Third-Party Sites and Apps
A security flaw in the implementation of the Open Authorization (OAuth) standard, which is widely used by websites and applications to connect to platforms like Facebook, Google, Apple, and Twitter, could enable attackers to hijack user accounts, access or leak sensitive data, and even commit financial fraud. |
May 24, 2023 |
|||
|
PyPI Back Online After Weekend Shutdown; Incident Deemed Overblown
The Python Package Index (PyPI) repository, which serves over 700,000 users and 450,000 projects, was temporarily shut down over the weekend, leading to speculation about an unusual surge of malicious packages or a cyberattack. |
May 22, 2023 |
|||
|
CISA Directs Government Agencies to Address iPhone Vulnerabilities Exploited in Attacks
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has instructed federal agencies to address three recently patched zero-day vulnerabilities affecting iPhones, Macs, and iPads, which are known to have been exploited in attacks. |
May 22, 2023 |
|||
|
US CISA Issues Warning on Actively Exploited Samsung Vulnerability
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the CVE-2023-21492 vulnerability to its Known Exploited Vulnerabilities Catalog, warning of active exploitation of the flaw in Samsung devices. |
May 20, 2023 |
|||
Vulnerabilities In The News |
||||
| CVE | Summary | Severity | Vendor | Risk Context |
| CVE-2023-33010 (4) | A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1... | CRITICAL |
Remote Code Execution |
|
| CVE-2023-33009 (4) | A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1,... | CRITICAL |
Remote Code Execution |
|
| CVE-2023-28771 (4) | Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions ... | CRITICAL | Zyxel |
Public Exploits Available |
| CVE-2023-28131 (3) | A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/web... | CRITICAL | Expo |
Remote Code Execution |
| CVE-2023-2868 (5) | A remote command injection vulnerability exists in the Barracuda Email Security Gateway product effecting versions 5.1.3.001... | CRITICAL | Barracuda Networks |
CISA Known Exploited Actively Exploited |
| CVE-2023-32784 (3) | In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace... | HIGH |
Actively Exploited Remote Code Execution Public Exploits Available |
|
CISA Known Exploited Vulnerabilities
CISA added four vulnerabilities to the known exploited vulnerabilities list.
Barracuda Networks — Email Security Gateway (ESG) Appliance |
|
CVE-2023-2868 / Added: May 26, 2023 |
|
CRITICAL CVSS 9.40 |
|
Barracuda Email Security Gateway (ESG) appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection. |
|
Headlines
|
Apple — Multiple Products |
|
CVE-2023-28204 / Added: May 22, 2023 |
|
CVSS Not Assigned |
|
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an out-of-bounds read vulnerability that may disclose sensitive information. |
|
Headlines
|
Apple — Multiple Products |
|
CVE-2023-32373 / Added: May 22, 2023 |
|
CVSS Not Assigned |
|
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain a use-after-free vulnerability that leads to code execution. |
|
Headlines
|
Apple — Multiple Products |
|
CVE-2023-32409 / Added: May 22, 2023 |
|
CVSS Not Assigned |
|
Apple iOS, iPadOS, macOS, tvOS, watchOS, and Safari WebKit contain an unspecified vulnerability that can allow a remote attacker to break out of the Web Content sandbox. |
|
Headlines
|
In The News
Vulnerabilities receiving the most attention in traditional news media.
CVE-2023-33010 |
|
CRITICAL CVSS 9.80 |
|
Remote Code Execution |
|
Published: May 24, 2023 |
|
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-33009 |
|
CRITICAL CVSS 9.80 |
|
Remote Code Execution |
|
Published: May 24, 2023 |
|
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device. |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-28771 |
|
CRITICAL CVSS 9.80 |
|
Public Exploits Available |
|
Published: April 25, 2023 |
|
Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device. |
|
Vendor Impacted: Zyxel |
|
Products Impacted: Zywall Usg 100 Firmware, Zywall Usg 310, Zywall Usg 310 Firmware |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-28131 |
|
CRITICAL CVSS 9.60 |
|
Remote Code Execution |
|
Published: April 24, 2023 |
|
A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that configured the "Expo AuthSession Redirect Proxy" for social sign-in. This can be achieved once a victim clicks a malicious link. The link itself may be sent to the victim in various ways (including email, text message, an attacker-controlled website, etc). |
|
Vendor Impacted: Expo |
|
Product Impacted: Expo Software Development Kit |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
CVE-2023-2868 |
|
CRITICAL CVSS 9.40 |
|
CISA Known Exploited Actively Exploited |
|
Published: May 24, 2023 |
|
A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances. |
|
Vendor Impacted: Barracuda Networks |
|
Product Impacted: Email Security Gateway (Esg) Appliance |
|
Quotes
|
|
Headlines
|
| Back to top ↑ |
CVE-2023-32784 |
|
HIGH CVSS 7.50 |
|
Actively Exploited Remote Code Execution Public Exploits Available |
|
Published: May 15, 2023 |
|
In KeePass 2.x before 2.54, it is possible to recover the cleartext master password from a memory dump, even when a workspace is locked or no longer running. The memory dump can be a KeePass process dump, swap file (pagefile.sys), hibernation file (hiberfil.sys), or RAM dump of the entire system. The first character cannot be recovered. In 2.54, there is different API usage and/or random string insertion for mitigation. |
|
Quotes
|
|
Headlines |
| Back to top ↑ |
Accelerate Security Teams
Schedule a free consultation with a vulnerability expert to discuss your use cases and to see a demo.
