Known Exploited

    Dashboard / Known Exploited

    Filters
    5.3
    Medium

    CVE-2023-41763

    Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:10 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763; https://nvd.nist.gov/vuln/detail/CVE-2023-41763

    6.5
    Medium

    CVE-2023-36563

    Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure.

    Alert Date:10 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36563; https://nvd.nist.gov/vuln/detail/CVE-2023-36563

    7.5
    High

    CVE-2023-44487

    HTTP/2 contains a rapid reset vulnerability that allows for a distributed denial-of-service attack (DDoS).

    Alert Date:10 Oct 2023
    Action:Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

    Note: This vulnerability affects a common open-source component, third-party library, or protocol used by different products. For more information, please see: HTTP/2 Rapid Reset Vulnerability, CVE-2023-44487 | CISA: https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487; https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack/; https://nvd.nist.gov/vuln/detail/CVE-2023-44487

    9.8
    Critical

    CVE-2023-22515

    Atlassian Confluence Data Center and Server contains a broken access control vulnerability that allows an attacker to create unauthorized Confluence administrator accounts and access Confluence.

    Alert Date:5 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Check all affected Confluence instances for evidence of compromise per vendor instructions and report any positive findings to CISA.

    Note: https://confluence.atlassian.com/security/cve-2023-22515-privilege-escalation-vulnerability-in-confluence-data-center-and-server-1295682276.html; https://nvd.nist.gov/vuln/detail/CVE-2023-22515

    10
    Critical

    CVE-2023-40044

    Progress WS_FTP Server contains a deserialization of untrusted data vulnerability in the Ad Hoc Transfer module that allows an authenticated attacker to execute remote commands on the underlying operating system.

    Alert Date:5 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://community.progress.com/s/article/WS-FTP-Server-Critical-Vulnerability-September-2023; https://nvd.nist.gov/vuln/detail/CVE-2023-40044

    7.8
    High

    CVE-2023-42824

    Apple iOS and iPadOS contain an unspecified vulnerability that allows for local privilege escalation.

    Alert Date:5 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213961; https://nvd.nist.gov/vuln/detail/CVE-2023-42824

    9.8
    Critical

    CVE-2023-42793

    JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server.

    Alert Date:4 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/ ; https://nvd.nist.gov/vuln/detail/CVE-2023-42793

    7
    High

    CVE-2023-28229

    Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.

    Alert Date:4 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28229; https://nvd.nist.gov/vuln/detail/CVE-2023-28229

    5.5
    Medium

    CVE-2023-4211

    Arm Mali GPU Kernel Driver contains a use-after-free vulnerability that allows a local, non-privileged user to make improper GPU memory processing operations to gain access to already freed memory.

    Alert Date:3 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://developer.arm.com/Arm%20Security%20Center/Mali%20GPU%20Driver%20Vulnerabilities; https://nvd.nist.gov/vuln/detail/CVE-2023-4211

    8.8
    High

    CVE-2023-5217

    Google Chromium libvpx contains a heap buffer overflow vulnerability in vp8 encoding that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could impact web browsers using libvpx, including but not limited to Google Chrome.

    Alert Date:2 Oct 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_27.html; https://nvd.nist.gov/vuln/detail/CVE-2023-5217

    9.8
    Critical

    CVE-2018-14667

    Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

    Alert Date:28 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14667; https://nvd.nist.gov/vuln/detail/CVE-2018-14667

    5.5
    Medium

    CVE-2023-41991

    Apple iOS, iPadOS, macOS, and watchOS contain an improper certificate validation vulnerability that can allow a malicious app to bypass signature validation.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931 ; https://nvd.nist.gov/vuln/detail/CVE-2023-41991

    7.8
    High

    CVE-2023-41992

    Apple iOS, iPadOS, macOS, and watchOS contain an unspecified vulnerability that allows for local privilege escalation.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213928, https://support.apple.com/en-us/HT213929, https://support.apple.com/en-us/HT213931, https://support.apple.com/en-us/HT213932; https://nvd.nist.gov/vuln/detail/CVE-2023-41992

    8.8
    High

    CVE-2023-41993

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Alert Date:25 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213926, https://support.apple.com/en-us/HT213927, https://support.apple.com/en-us/HT213930; https://nvd.nist.gov/vuln/detail/CVE-2023-41993

    7.2
    High

    CVE-2023-41179

    Trend Micro Apex One and Worry-Free Business Security contain an unspecified vulnerability in the third-party anti-virus uninstaller that could allow an attacker to manipulate the module to conduct remote code execution. An attacker must first obtain administrative console access on the target system in order to exploit this vulnerability.

    Alert Date:21 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://success.trendmicro.com/dcx/s/solution/000294994?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-41179

    8.8
    High

    CVE-2023-28434

    MinIO contains a security feature bypass vulnerability that allows an attacker to use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket` to conduct privilege escalation. To carry out this attack, the attacker requires credentials with `arn:aws:s3:::*` permission, as well as enabled Console API access.

    Alert Date:19 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://github.com/minio/minio/security/advisories/GHSA-2pxw-r47w-4p8c; https://nvd.nist.gov/vuln/detail/CVE-2023-28434

    5
    Medium

    CVE-2022-22265

    Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://security.samsungmobile.com/securityUpdate.smsb?year=2022&month=1; https://nvd.nist.gov/vuln/detail/CVE-2022-22265

    9.8
    Critical

    CVE-2014-8361

    Realtek SDK contains an improper input validation vulnerability in the miniigd SOAP service that allows remote attackers to execute malicious code via a crafted NewInternalClient request.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://web.archive.org/web/20150831100501/http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10055; https://nvd.nist.gov/vuln/detail/CVE-2014-8361

    8.8
    High

    CVE-2017-6884

    Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI.

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-emg2926-q10a-ethernet-cpe, https://www.zyxelguard.com/Zyxel-EOL.asp; https://nvd.nist.gov/vuln/detail/CVE-2017-6884

    9.8
    Critical

    CVE-2021-3129

    Laravel Ignition contains a file upload vulnerability that allows unauthenticated remote attackers to execute malicious code due to insecure usage of file_get_contents() and file_put_contents().

    Alert Date:18 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://github.com/facade/ignition/releases/tag/2.5.2; https://nvd.nist.gov/vuln/detail/CVE-2021-3129

    7.8
    High

    CVE-2023-26369

    Adobe Acrobat and Reader contains an out-of-bounds write vulnerability that allows for code execution.

    Alert Date:14 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/acrobat/apsb23-34.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26369

    8.8
    High

    CVE-2023-35674

    Android Framework contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://source.android.com/docs/security/bulletin/2023-09-01; https://nvd.nist.gov/vuln/detail/CVE-2023-35674

    5
    Medium

    CVE-2023-20269

    Cisco Adaptive Security Appliance and Firepower Threat Defense contain an unauthorized access vulnerability that could allow an unauthenticated, remote attacker to conduct a brute force attack in an attempt to identify valid username and password combinations or establish a clientless SSL VPN session with an unauthorized user.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions for group-lock and vpn-simultaneous-logins or discontinue use of the product for unsupported devices.

    Note: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-ravpn-auth-8LyfCkeC; https://nvd.nist.gov/vuln/detail/CVE-2023-20269

    8.8
    High

    CVE-2023-4863

    Google Chromium WebP contains a heap-based buffer overflow vulnerability that allows a remote attacker to perform an out-of-bounds memory write via a crafted HTML page. This vulnerability can affect applications that use the WebP Codec.

    Alert Date:13 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html?m=1; https://nvd.nist.gov/vuln/detail/CVE-2023-4863

    6.5
    Medium

    CVE-2023-36761

    Microsoft Word contains an unspecified vulnerability that allows for information disclosure.

    Alert Date:12 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36761; https://nvd.nist.gov/vuln/detail/CVE-2023-36761

    7.8
    High

    CVE-2023-36802

    Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:12 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802; https://nvd.nist.gov/vuln/detail/CVE-2023-36802

    7.8
    High

    CVE-2023-41064

    Apple iOS, iPadOS, and macOS contain a buffer overflow vulnerability in ImageIO when processing a maliciously crafted image, which may lead to code execution. This vulnerability was chained with CVE-2023-41061.

    Alert Date:11 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213905, https://support.apple.com/en-us/HT213906; https://nvd.nist.gov/vuln/detail/CVE-2023-41064

    7.8
    High

    CVE-2023-41061

    Apple iOS, iPadOS, and watchOS contain an unspecified vulnerability due to a validation issue affecting Wallet in which a maliciously crafted attachment may result in code execution. This vulnerability was chained with CVE-2023-41064.

    Alert Date:11 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213905, https://support.apple.com/kb/HT213907; https://nvd.nist.gov/vuln/detail/CVE-2023-41061

    9.8
    Critical

    CVE-2023-33246

    Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lack permission verification. An attacker can exploit this vulnerability by using the update configuration function to execute commands as the system users that RocketMQ is running as or achieve the same effect by forging the RocketMQ protocol content.

    Alert Date:6 Sept 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://lists.apache.org/thread/1s8j2c8kogthtpv3060yddk03zq0pxyp; https://nvd.nist.gov/vuln/detail/CVE-2023-33246

    7.8
    High

    CVE-2023-38831

    RARLAB WinRAR contains an unspecified vulnerability that allows an attacker to execute code when a user attempts to view a benign file within a ZIP archive.

    Alert Date:24 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: http://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=232&cHash=c5bf79590657e32554c6683296a8e8aa; https://nvd.nist.gov/vuln/detail/CVE-2023-38831

    8.6
    High

    CVE-2023-32315

    Ignite Realtime Openfire contains a path traversal vulnerability that allows an unauthenticated attacker to access restricted pages in the Openfire Admin Console reserved for administrative users.

    Alert Date:24 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.igniterealtime.org/downloads/#openfire; https://nvd.nist.gov/vuln/detail/CVE-2023-32315

    9.8
    Critical

    CVE-2023-38035

    Ivanti Sentry, formerly known as MobileIron Sentry, contains an authentication bypass vulnerability that may allow an attacker to bypass authentication controls on the administrative interface due to an insufficiently restrictive Apache HTTPD configuration.

    Alert Date:22 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-38035-API-Authentication-Bypass-on-Sentry-Administrator-Interface?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-38035

    7.5
    High

    CVE-2023-27532

    Veeam Backup & Replication Cloud Connect component contains a missing authentication for critical function vulnerability that allows an unauthenticated user operating within the backup infrastructure network perimeter to obtain encrypted credentials stored in the configuration database. This may lead to an attacker gaining access to the backup infrastructure hosts.

    Alert Date:22 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.veeam.com/kb4424; https://nvd.nist.gov/vuln/detail/CVE-2023-27532

    9.8
    Critical

    CVE-2023-26359

    Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could result in code execution in the context of the current user.

    Alert Date:21 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-25.html; https://nvd.nist.gov/vuln/detail/CVE-2023-26359

    9.8
    Critical

    CVE-2023-24489

    Citrix Content Collaboration contains an improper access control vulnerability that could allow an unauthenticated attacker to remotely compromise customer-managed ShareFile storage zones controllers.

    Alert Date:16 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.citrix.com/article/CTX559517/sharefile-storagezones-controller-security-update-for-cve202324489; https://nvd.nist.gov/vuln/detail/CVE-2023-24489

    7.5
    High

    CVE-2023-38180

    Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).

    Alert Date:9 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180; https://nvd.nist.gov/vuln/detail/CVE-2023-38180

    9.8
    Critical

    CVE-2017-18368

    Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page.

    Alert Date:7 Aug 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-a-new-variant-of-gafgyt-malware; https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-command-injection-vulnerability-in-p660hn-t1a-dsl-cpe; https://nvd.nist.gov/vuln/detail/CVE-2017-18368

    7.2
    High

    CVE-2023-35081

    Ivanti Endpoint Manager Mobile (EPMM) contains a path traversal vulnerability that enables an authenticated administrator to perform malicious file writes to the EPMM server. This vulnerability can be used in conjunction with CVE-2023-35078 to bypass authentication and ACLs restrictions (if applicable).

    Alert Date:31 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-35081-Arbitrary-File-Write?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35081

    6.1
    Medium

    CVE-2023-37580

    Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

    Alert Date:27 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2023-37580

    5.5
    Medium

    CVE-2023-38606

    Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability allowing an app to modify a sensitive kernel state.

    Alert Date:26 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213842, https://support.apple.com/en-us/HT213843,https://support.apple.com/en-us/HT213844,https://support.apple.com/en-us/HT213845,https://support.apple.com/en-us/HT213846,https://support.apple.com/en-us/HT213848 ; https://nvd.nist.gov/vuln/detail/CVE-2023-38606

    9.8
    Critical

    CVE-2023-35078

    Ivanti Endpoint Manager Mobile (EPMM, previously branded MobileIron Core) contains an authentication bypass vulnerability that allows unauthenticated access to specific API paths. An attacker with access to these API paths can access personally identifiable information (PII) such as names, phone numbers, and other mobile device details for users on a vulnerable system. An attacker can also make other configuration changes including installing software and modifying security profiles on registered devices.

    Alert Date:25 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability?language=en_US; https://nvd.nist.gov/vuln/detail/CVE-2023-35078

    7.5
    High

    CVE-2023-29298

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

    Alert Date:20 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-40.html; https://nvd.nist.gov/vuln/detail/CVE-2023-29298

    7.5
    High

    CVE-2023-38205

    Adobe ColdFusion contains an improper access control vulnerability that allows for a security feature bypass.

    Alert Date:20 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://helpx.adobe.com/security/products/coldfusion/apsb23-47.html ; https://nvd.nist.gov/vuln/detail/CVE-2023-38205

    9.8
    Critical

    CVE-2023-3519

    Citrix NetScaler ADC and NetScaler Gateway contains a code injection vulnerability that allows for unauthenticated remote code execution.

    Alert Date:19 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://support.citrix.com/article/CTX561482/citrix-adc-and-citrix-gateway-security-bulletin-for-cve20233519-cve20233466-cve20233467; https://nvd.nist.gov/vuln/detail/CVE-2023-3519

    7.5
    High

    CVE-2023-36884

    Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.

    Alert Date:17 Jul 2023
    Action:Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

    Note: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884; https://nvd.nist.gov/vuln/detail/CVE-2023-36884

    9.8
    Critical

    CVE-2022-29303

    SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server.

    Alert Date:13 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://jvn.jp/en/vu/JVNVU92327282/; https://nvd.nist.gov/vuln/detail/CVE-2022-29303

    8.8
    High

    CVE-2023-37450

    Apple iOS, iPadOS, macOS, and Safari WebKit contain an unspecified vulnerability that leads to code execution when processing maliciously crafted web content. This vulnerability could impact HTML parsers that use WebKit, including but not limited to Apple Safari and non-Apple products which rely on WebKit for HTML processing.

    Alert Date:13 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://support.apple.com/en-us/HT213826, https://support.apple.com/en-us/HT213841, https://support.apple.com/en-us/HT213843, https://support.apple.com/en-us/HT213846, https://support.apple.com/en-us/HT213848; https://nvd.nist.gov/vuln/detail/CVE-2023-37450

    7.8
    High

    CVE-2023-32046

    Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046; https://nvd.nist.gov/vuln/detail/CVE-2023-32046

    8.8
    High

    CVE-2023-32049

    Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049; https://nvd.nist.gov/vuln/detail/CVE-2023-32049

    8.8
    High

    CVE-2023-35311

    Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.

    Alert Date:11 Jul 2023
    Action:Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

    Note: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311; https://nvd.nist.gov/vuln/detail/CVE-2023-35311

    Items Per Page