Exploited vulnerabilities (CISA KEV)

CVE-2023-36844 Medium · 5.3 KEV High · 66 Public exploit CWE-473 Aug 17, 2023

Juniper Junos OS EX Series PHP External Variable Modification Vulnerability

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

CVE-2023-35082 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Aug 15, 2023

Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This vulnerability is unique to CVE-2023-35078 announced earlier.

CVE-2022-48503 High · 8.8 KEV High · 54 CWE-129 Aug 14, 2023

Apple Multiple Products Unspecified Vulnerability

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

CVE-2023-38180 High · 7.5 KEV High · 58 CWE-400 Aug 8, 2023

Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability

.NET and Visual Studio Denial of Service Vulnerability

CVE-2023-38950 High · 7.5 KEV High · 63 Public exploit CWE-22 Aug 3, 2023

ZKTeco BioTime Path Traversal Vulnerability

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

CVE-2023-35081 High · 7.2 KEV High · 56 CWE-22 Aug 3, 2023

Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability

A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the appliance.

CVE-2023-37580 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Jul 31, 2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CVE-2023-38606 Medium · 5.5 KEV High · 51 Jul 26, 2023

Apple Multiple Products Kernel Unspecified Vulnerability

This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS Ventura 13.5, watchOS 9.6. An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1.

CVE-2023-37450 High · 8.8 KEV High · 56 Jul 26, 2023

Apple Multiple Products WebKit Code Execution Vulnerability

The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-35078 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-287 Jul 25, 2023

Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.

CVE-2023-38203 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 20, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u17 (and earlier), 2021u7 (and earlier) and 2023u1 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-3519 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware CWE-94 Jul 19, 2023

Citrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability

Unauthenticated remote code execution

CVE-2023-29298 High · 7.5 KEV High · 63 Public exploit CWE-284 Jul 12, 2023

Adobe ColdFusion Improper Access Control Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

CVE-2023-29300 Critical · 9.8 KEV Urgent · 87 Public exploit Ransomware CWE-502 Jul 12, 2023

Adobe ColdFusion Deserialization of Untrusted Data Vulnerability

Adobe ColdFusion versions 2018u16 (and earlier), 2021u6 (and earlier) and 2023.0.0.330468 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction.

CVE-2023-36884 High · 7.5 KEV Urgent · 72 Public exploit Ransomware CWE-362 Jul 11, 2023

Microsoft Windows Search Remote Code Execution Vulnerability

Windows Search Remote Code Execution Vulnerability

CVE-2023-36874 High · 7.8 KEV Urgent · 74 Public exploit CWE-59 Jul 11, 2023

Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability

Windows Error Reporting Service Elevation of Privilege Vulnerability

CVE-2023-35311 High · 8.8 KEV High · 56 CWE-367 Jul 11, 2023

Microsoft Outlook Security Feature Bypass Vulnerability

CVE-2023-32049 High · 8.8 KEV High · 55 Jul 11, 2023

Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2023-32046 High · 7.8 KEV High · 55 Jul 11, 2023

Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability

Windows MSHTML Platform Elevation of Privilege Vulnerability

CVE-2023-24489 Critical · 9.8 KEV Urgent · 73 Public exploit CWE-284 Jul 10, 2023

Citrix Content Collaboration ShareFile Improper Access Control Vulnerability

A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-managed ShareFile storage zones controller.

CVE-2023-34192 Critical · 9.0 KEV High · 64 Public exploit CWE-79 Jul 6, 2023

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

CVE-2023-21237 Medium · 5.5 KEV CWE-200 Jun 28, 2023

Android Pixel Information Disclosure Vulnerability

In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912

CVE-2023-32409 High · 8.6 KEV High · 59 Jun 23, 2023

Apple Multiple Products WebKit Sandbox Escape Vulnerability

The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari 16.5, iOS 16.5 and iPadOS 16.5. A remote attacker may be able to break out of Web Content sandbox. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-32439 High · 8.8 KEV High · 56 CWE-843 Jun 23, 2023

Apple Multiple Products WebKit Type Confusion Vulnerability

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 16.5.1 and iPadOS 16.5.1, iOS 15.7.7 and iPadOS 15.7.7, macOS Ventura 13.4.1, Safari 16.5.1. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2023-32435 High · 8.8 KEV High · 56 CWE-787 Jun 23, 2023

Apple Multiple Products WebKit Memory Corruption Vulnerability

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.