Vulnerabilidades exploradas (CISA KEV)

CVE-2023-29552 Alta · 7.5 KEV Alta · 59 25/04/2023

Service Location Protocol (SLP) Denial-of-Service Vulnerability

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CVE-2023-28771 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-78 24/04/2023

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

CVE-2023-27524 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-1188 24/04/2023

Apache Superset: inicialização insegura de recurso por padrão

Ataques de validação de sessão no Apache Superset em versões até a 2.0.1 inclusive. Instalações que não alteraram o valor padrão do SECRET_KEY configurado conforme as instruções de instalação permitem que um atacante se autentique e acesse recursos não autorizados. Isso não afeta administradores do Superset que tenham alterado o valor padrão de SECRET_KEY. Todas as instalações do Superset devem sempre definir um SECRET_KEY único, aleatório e seguro. Seu SECRET_KEY é usado para assinar com segurança todos os cookies de sessão e para criptografar informações sensíveis no banco de dados. Adicione um SECRET_KEY forte ao seu arquivo `superset_config.py`, como: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternativamente, você pode defini-lo com a variável de ambiente `SUPERSET_SECRET_KEY`.

CVE-2023-27350 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 20/04/2023

PaperCut MF/NG Improper Access Control Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

CVE-2023-27351 Alta · 7.5 KEV Urgente · 73 Exploit público Ransomware CWE-287 20/04/2023

PaperCut NG/MF Improper Authentication Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

CVE-2023-22894 Média · 4.9 KEV Alta · 58 Exploit público CWE-312 19/04/2023

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

CVE-2023-2136 Crítica · 9.6 KEV Alta · 59 CWE-190 19/04/2023

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2033 Alta · 8.8 KEV Alta · 62 Exploit público CWE-843 14/04/2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-20118 Alta · 7.2 KEV Alta · 56 CWE-77 13/04/2023

Cisco Small Business RV Series Routers Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section. {{value}} ["%7b%7bvalue%7d%7d"])}]]

CVE-2023-28252 Alta · 7.8 KEV Urgente · 84 Exploit público Ransomware CWE-787 11/04/2023

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2023-28229 Alta · 7.0 KEV Alta · 59 Exploit público CWE-591 11/04/2023

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

CVE-2023-29492 Crítica · 9.8 KEV Alta · 61 CWE-94 11/04/2023

Novi Survey Insecure Deserialization Vulnerability

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

CVE-2023-28206 Alta · 8.6 KEV Alta · 62 Exploit público CWE-787 10/04/2023

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-28205 Alta · 8.8 KEV Alta · 62 Exploit público CWE-416 10/04/2023

Apple Multiple Products WebKit Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-26083 Baixa · 3.3 KEV Alta · 51 Exploit público CWE-401 06/04/2023

Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

CVE-2023-1671 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-77 04/04/2023

Sophos Web Appliance Command Injection Vulnerability

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

CVE-2022-43939 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-647 03/04/2023

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

CVE-2022-43769 Alta · 7.2 KEV Urgente · 76 Exploit público CWE-94 03/04/2023

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.