Exploited vulnerabilities (CISA KEV)

CVE-2023-37580 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Jul 31, 2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CVE-2023-38606 Medium · 5.5 KEV High · 51 Jul 26, 2023

Apple Multiple Products Kernel Unspecified Vulnerability

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

CVE-2023-37450 High · 8.8 KEV High · 56 Jul 26, 2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-35078 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 25, 2023

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

CVE-2023-38203 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 20, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-3519 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-94 Jul 19, 2023

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Unauthenticated remote code execution

CVE-2023-29298 High · 7.5 KEV High · 63 Public exploit CWE-284 Jul 12, 2023

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

CVE-2023-29300 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 12, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-36884 High · 7.5 KEV Urgent · 72 Public exploit Ransomware CWE-362 Jul 11, 2023

Microsoft Windows Search Remote Code Execution Vulnerability

Windows Search Remote Code Execution Vulnerability

CVE-2023-36874 High · 7.8 KEV Urgent · 74 Public exploit CWE-59 Jul 11, 2023

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2023-35311 High · 8.8 KEV High · 56 CWE-367 Jul 11, 2023

Microsoft Outlook Security Feature Bypass Vulnerability

CVE-2023-32049 High · 8.8 KEV High · 55 Jul 11, 2023

Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2023-32046 High · 7.8 KEV High · 55 Jul 11, 2023

Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Windows MSHTML Platform Elevation of Privilege Vulnerability

CVE-2023-24489 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-284 Jul 10, 2023

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.

CVE-2023-34192 Critical · 9.0 KEV High · 64 Public exploit CWE-79 Jul 6, 2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.