Vulnerabilidades exploradas (CISA KEV)

CVE-2023-27992 Crítica · 9.8 KEV Alta · 63 CWE-78 19/06/2023

Zyxel Multiple NAS Devices Command Injection Vulnerability

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware versions prior to V5.21(AATB.11)C0, and NAS542 firmware versions prior to V5.21(ABAG.11)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands remotely by sending a crafted HTTP request.

CVE-2023-29360 Alta · 8.4 KEV Alta · 62 Exploit público CWE-822 13/06/2023

Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability

Microsoft Streaming Service Elevation of Privilege Vulnerability

CVE-2023-29357 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-303 13/06/2023

Microsoft SharePoint Server Privilege Escalation Vulnerability

Microsoft SharePoint Server Elevation of Privilege Vulnerability

CVE-2023-20867 Baixa · 3.9 KEV Alta · 59 CWE-287 13/06/2023

VMware Tools Authentication Bypass Vulnerability

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CVE-2023-27997 Crítica · 9.8 KEV Urgente · 79 Exploit público Ransomware CWE-787 13/06/2023

Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability

A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and below and FortiProxy version 7.2.3 and below, version 7.0.9 and below, version 2.0.12 and below, version 1.2 all versions, version 1.1 all versions SSL-VPN may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests.

CVE-2023-20887 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-77 07/06/2023

Vmware Aria Operations for Networks Command Injection Vulnerability

Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be able to perform a command injection attack resulting in remote code execution.

CVE-2023-33538 Alta · 8.8 KEV Alta · 65 Exploit público CWE-77 07/06/2023

TP-Link Multiple Routers Command Injection Vulnerability

TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm .

CVE-2023-3079 Alta · 8.8 KEV Alta · 62 Exploit público CWE-843 05/06/2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-34362 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-89 02/06/2023

Progress MOVEit Transfer SQL Injection Vulnerability

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

CVE-2023-32315 Alta · 7.5 KEV Urgente · 79 Exploit público CWE-22 26/05/2023

Ignite Realtime Openfire: Path Traversal

O Openfire é um servidor XMPP licenciado sob a Open Source Apache License. Constatou-se que o console administrativo do Openfire, uma aplicação web, é vulnerável a um ataque de path traversal por meio do ambiente de setup. Isso permitia que um usuário não autenticado utilizasse o ambiente de setup não autenticado de um Openfire já configurado para acessar páginas restritas do console administrativo, reservadas a usuários administradores. Esta vulnerabilidade afeta todas as versões do Openfire lançadas desde abril de 2015, a partir da versão 3.10.0. O problema foi corrigido nas versões 4.7.5 e 4.6.8 do Openfire, e melhorias adicionais serão incluídas na primeira versão ainda não lançada do ramo 4.8 (que deve ser a versão 4.8.0). Recomenda-se que os usuários atualizem. Se não houver uma atualização do Openfire para uma versão específica, ou se ela não puder ser aplicada rapidamente, os usuários podem consultar o aviso do GitHub (GHSA-gw42-f939-fhvm) para orientações de mitigação.

CVE-2023-2868 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-77 24/05/2023

Barracuda Networks ESG Appliance Improper Input Validation Vulnerability

A remote command injection vulnerability exists in the Barracuda Email Security Gateway (appliance form factor only) product effecting versions 5.1.3.001-9.2.0.006. The vulnerability arises out of a failure to comprehensively sanitize the processing of .tar file (tape archives). The vulnerability stems from incomplete input validation of a user-supplied .tar file as it pertains to the names of the files contained within the archive. As a consequence, a remote attacker can specifically format these file names in a particular manner that will result in remotely executing a system command through Perl's qx operator with the privileges of the Email Security Gateway product. This issue was fixed as part of BNSF-36456 patch. This patch was automatically applied to all customer appliances.

CVE-2023-33246 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 24/05/2023

Vulnerabilidade de Execução de Comandos no Apache RocketMQ

Para o RocketMQ nas versões 5.1.0 e anteriores, sob certas condições, existe risco de execução remota de comandos. Vários componentes do RocketMQ, incluindo NameServer, Broker e Controller, estão expostos na extranet e não possuem verificação de permissão; um atacante pode explorar esta vulnerabilidade usando a função de atualização de configuração para executar comandos como os usuários do sistema sob os quais o RocketMQ está em execução. Adicionalmente, um atacante pode obter o mesmo efeito forjando o conteúdo do protocolo RocketMQ. Para prevenir esses ataques, recomenda-se que os usuários atualizem para a versão 5.1.1 ou superior, caso utilizem o RocketMQ da linha 5, ou para a versão 4.9.6 ou superior, caso utilizem o RocketMQ da linha 4.

CVE-2023-33010 Crítica · 9.8 KEV Alta · 63 CWE-120 24/05/2023

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.25 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.25 through 5.36 Patch 1, VPN series firmware versions 4.30 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.25 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

CVE-2023-33009 Crítica · 9.8 KEV Alta · 63 CWE-120 24/05/2023

Zyxel Multiple Firewalls Buffer Overflow Vulnerability

A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 50(W) firmware versions 4.60 through 5.36 Patch 1, USG20(W)-VPN firmware versions 4.60 through 5.36 Patch 1, VPN series firmware versions 4.60 through 5.36 Patch 1, ZyWALL/USG series firmware versions 4.60 through 4.73 Patch 1, could allow an unauthenticated attacker to cause denial-of-service (DoS) conditions and even a remote code execution on an affected device.

CVE-2023-29336 Alta · 7.8 KEV Urgente · 70 Exploit público CWE-416 09/05/2023

Microsoft Win32K Privilege Escalation Vulnerability

Win32k Elevation of Privilege Vulnerability

CVE-2023-24955 Alta · 7.2 KEV Urgente · 84 Exploit público Ransomware CWE-94 09/05/2023

Microsoft SharePoint Server Code Injection Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

CVE-2023-21492 Média · 4.4 KEV Alta · 51 CWE-532 04/05/2023

Samsung Mobile Devices Insertion of Sensitive Information Into Log File Vulnerability

Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.

CVE-2023-29552 Alta · 7.5 KEV Alta · 59 25/04/2023

Service Location Protocol (SLP) Denial-of-Service Vulnerability

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CVE-2023-28771 Crítica · 9.8 KEV Urgente · 81 Exploit público CWE-78 24/04/2023

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

CVE-2023-27524 Crítica · 9.8 KEV Urgente · 80 Exploit público CWE-1188 24/04/2023

Apache Superset: inicialização insegura de recurso por padrão

Ataques de validação de sessão no Apache Superset em versões até a 2.0.1 inclusive. Instalações que não alteraram o valor padrão do SECRET_KEY configurado conforme as instruções de instalação permitem que um atacante se autentique e acesse recursos não autorizados. Isso não afeta administradores do Superset que tenham alterado o valor padrão de SECRET_KEY. Todas as instalações do Superset devem sempre definir um SECRET_KEY único, aleatório e seguro. Seu SECRET_KEY é usado para assinar com segurança todos os cookies de sessão e para criptografar informações sensíveis no banco de dados. Adicione um SECRET_KEY forte ao seu arquivo `superset_config.py`, como: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternativamente, você pode defini-lo com a variável de ambiente `SUPERSET_SECRET_KEY`.

CVE-2023-27350 Crítica · 9.8 KEV Urgente · 93 Exploit público Ransomware CWE-284 20/04/2023

PaperCut MF/NG Improper Access Control Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

CVE-2023-27351 Alta · 7.5 KEV Urgente · 73 Exploit público Ransomware CWE-287 20/04/2023

PaperCut NG/MF Improper Authentication Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

CVE-2023-22894 Média · 4.9 KEV Alta · 57 Exploit público CWE-312 19/04/2023

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

CVE-2023-2136 Crítica · 9.6 KEV Alta · 59 CWE-190 19/04/2023

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2033 Alta · 8.8 KEV Alta · 62 Exploit público CWE-843 14/04/2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)