Exploited vulnerabilities (CISA KEV)

CVE-2023-42916 Medium · 6.5 KEV High · 53 CWE-125 Nov 30, 2023

Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability

An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sensitive information. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-42917 High · 8.8 KEV High · 55 CWE-787 Nov 30, 2023

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited against versions of iOS before iOS 16.7.1.

CVE-2023-6345 Critical · 9.6 KEV High · 63 CWE-190 Nov 29, 2023

Google Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVE-2023-46604 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-502 Oct 27, 2023

Apache ActiveMQ Deserialization of Untrusted Data Vulnerability

The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.

CVE-2023-5631 Medium · 5.4 KEV High · 53 CWE-79 Oct 18, 2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

CVE-2023-44487 High · 7.5 KEV Urgent · 73 Public exploit CWE-400 Oct 10, 2023

HTTP/2 Rapid Reset Attack Vulnerability

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2023-4911 High · 7.8 KEV Urgent · 76 Public exploit CWE-787 Oct 3, 2023

GNU C Library Buffer Overflow Vulnerability

A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

CVE-2023-5217 High · 8.8 KEV High · 62 Public exploit CWE-787 Sep 28, 2023

Google Chromium libvpx Heap Buffer Overflow Vulnerability

Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-43770 Medium · 6.1 KEV High · 59 Public exploit CWE-79 Sep 22, 2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

CVE-2023-41993 High · 8.8 KEV High · 62 Public exploit CWE-754 Sep 21, 2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7.

CVE-2023-4863 High · 8.8 KEV High · 62 Public exploit CWE-787 Sep 12, 2023

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

CVE-2023-4762 High · 8.8 KEV High · 62 Public exploit CWE-843 Sep 5, 2023

Google Chromium V8 Type Confusion Vulnerability

Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

CVE-2023-20867 Low · 3.9 KEV High · 59 CWE-287 Jun 13, 2023

VMware Tools Authentication Bypass Vulnerability

A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine.

CVE-2023-3079 High · 8.8 KEV High · 62 Public exploit CWE-843 Jun 5, 2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2136 Critical · 9.6 KEV High · 59 CWE-190 Apr 19, 2023

Google Chrome Skia Integer Overflow Vulnerability

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2023-2033 High · 8.8 KEV High · 62 Public exploit CWE-843 Apr 14, 2023

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2023-0386 High · 7.8 KEV Urgent · 73 Public exploit CWE-282 Mar 22, 2023

Linux Kernel Improper Ownership Management Vulnerability

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

CVE-2023-0266 High · 7.0 KEV High · 60 Public exploit CWE-416 Jan 30, 2023

Linux Kernel Use-After-Free Vulnerability

A use after free vulnerability exists in the ALSA PCM package in the Linux Kernel. SNDRV_CTL_IOCTL_ELEM_{READ|WRITE}32 is missing locks that can be used in a use-after-free that can result in a priviledge escalation to gain ring0 access from the system user. We recommend upgrading past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e

CVE-2022-32893 High · 8.8 KEV High · 55 CWE-787 Aug 24, 2022

Apple iOS and macOS Out-of-Bounds Write Vulnerability

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6.1 and iPadOS 15.6.1, macOS Monterey 12.5.1, Safari 15.6.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2022-30333 High · 7.5 KEV Urgent · 87 Public exploit Ransomware CWE-22 May 9, 2022

RARLAB UnRAR Directory Traversal Vulnerability

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) operation, as demonstrated by creating a ~/.ssh/authorized_keys file. NOTE: WinRAR and Android RAR are unaffected.

CVE-2022-0492 High · 7.8 KEV Urgent · 73 Public exploit CWE-862 Mar 3, 2022

Linux Kernel Improper Authentication Vulnerability

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

CVE-2021-3560 High · 7.8 KEV Urgent · 76 Public exploit CWE-754 Feb 16, 2022

Red Hat Polkit Incorrect Authorization Vulnerability

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVE-2021-22600 High · 7.0 KEV High · 61 Public exploit CWE-415 Jan 26, 2022

Linux Kernel Privilege Escalation Vulnerability

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

CVE-2022-23134 Medium · 5.3 KEV High · 63 Public exploit CWE-287 Jan 13, 2022

Zabbix Frontend Improper Access Control Vulnerability

After the initial setup process, some steps of setup.php file are reachable not only by super-administrators, but by unauthenticated users as well. Malicious actor can pass step checks and potentially change the configuration of Zabbix Frontend.

CVE-2021-0920 Medium · 6.4 KEV High · 47 CWE-362 Dec 15, 2021

Android Kernel Race Condition Vulnerability

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel