Exploited vulnerabilities (CISA KEV)

CVE-2023-29552 High · 7.5 KEV High · 59 Apr 25, 2023

Service Location Protocol (SLP) Denial-of-Service Vulnerability

The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial-of-service attack with a significant amplification factor.

CVE-2023-28771 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-78 Apr 24, 2023

Zyxel Multiple Firewalls OS Command Injection Vulnerability

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to execute some OS commands remotely by sending crafted packets to an affected device.

CVE-2023-27524 Critical · 9.8 KEV Urgent · 80 Public exploit CWE-1188 Apr 24, 2023

Apache Superset Insecure Default Initialization of Resource Vulnerability

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

CVE-2023-27350 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-284 Apr 20, 2023

PaperCut MF/NG Improper Access Control Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.

CVE-2023-27351 High · 7.5 KEV Urgent · 73 Public exploit Ransomware CWE-287 Apr 20, 2023

PaperCut NG/MF Improper Authentication Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SecurityRequestFilter class. The issue results from improper implementation of the authentication algorithm. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-19226.

CVE-2023-22894 Medium · 4.9 KEV High · 58 Public exploit CWE-312 Apr 19, 2023

Strapi Cleartext Storage of Sensitive Information Vulnerability

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

CVE-2023-2136 Critical · 9.6 KEV High · 59 CWE-190 Apr 19, 2023

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2033 High · 8.8 KEV High · 62 Public exploit CWE-843 Apr 14, 2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-20118 High · 7.2 KEV High · 56 CWE-77 Apr 13, 2023

Cisco Small Business RV Series Routers Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper validation of user input within incoming HTTP packets. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web-based management interface. A successful exploit could allow the attacker to gain root-level privileges and access unauthorized data. To exploit this vulnerability, an attacker would need to have valid administrative credentials on the affected device. Cisco has not and will not release software updates that address this vulnerability. However, administrators may disable the affected feature as described in the Workarounds ["#workarounds"] section. {{value}} ["%7b%7bvalue%7d%7d"])}]]

CVE-2023-28252 High · 7.8 KEV Urgent · 84 Public exploit Ransomware CWE-787 Apr 11, 2023

Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability

Windows Common Log File System Driver Elevation of Privilege Vulnerability

CVE-2023-28229 High · 7.0 KEV High · 59 Public exploit CWE-591 Apr 11, 2023

Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability

Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

CVE-2023-29492 Critical · 9.8 KEV High · 61 CWE-94 Apr 11, 2023

Novi Survey Insecure Deserialization Vulnerability

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

CVE-2023-28206 High · 8.6 KEV High · 62 Public exploit CWE-787 Apr 10, 2023

Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-28205 High · 8.8 KEV High · 62 Public exploit CWE-416 Apr 10, 2023

Apple Multiple Products WebKit Use-After-Free Vulnerability

A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-26083 Low · 3.3 KEV High · 51 Public exploit CWE-401 Apr 6, 2023

Arm Mali GPU Kernel Driver Information Disclosure Vulnerability

Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver all versions from r19p0 - r42p0, and Avalon GPU Kernel Driver all versions from r41p0 - r42p0 allows a non-privileged user to make valid GPU processing operations that expose sensitive kernel metadata.

CVE-2023-1671 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-77 Apr 4, 2023

Sophos Web Appliance Command Injection Vulnerability

A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.

CVE-2022-43939 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-647 Apr 3, 2023

Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.

CVE-2022-43769 High · 7.2 KEV Urgent · 76 Public exploit CWE-94 Apr 3, 2023

Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.