CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-20198 Cisco IOS XE Web UI Privilege Escalation Vulnerabilitylink is external These types of vulnerabilities are frequent attack vectors for malicious cyber actor...

CISA Releases New Resources Identifying Known Exploited Vulnerabilities and Misconfigurations Linked to Ransomware

Today, as part of the Ransomware Vulnerability Warning Pilot RVWP, CISA launched two new resources for combating ransomware campaigns: A “Known to be Used in Ransomware Campaigns” column in the KEV Catalog that identifies KEVs associated with ransomware campaigns. A “Misconfigurations and...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation: CVE-2023-40044 Progress WSFTP Server Deserialization of Untrusted Data Vulnerability CVE-2023-42824 Apple iOS and iPadOS Kernel Privilege Escalation Vulnerability...

CVE-2023-22515

creationtimestamp| type| source ---|---|--- 2023-10-04 18:12:23+00:00| seen| https://t.me/cibsecurity/71588 2023-10-04 18:18:27+00:00| published-proof-of-concept| https://t.me/CyberWatchinsider/127 2023-10-04 22:49:19+00:00| exploited| https://t.me/ctinow/141225 2023-10-04 22:58:56+00:00|...

CISA Adds Two Known Exploited Vulnerabilities to Catalog, Removes Five KEVs

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation: CVE-2023-42793 JetBrains TeamCity Authentication Bypass Vulnerability CVE-2023-28229 Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability Thes...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-4211 Arm Mali GPU Kernel Driver Use-After-Free Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-5217 Google Chrome libvpx Heap Buffer Overflow Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2018-14667 Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cybe...

CVE-2023-35813

creationtimestamp| type| source ---|---|--- 2023-09-26 15:23:42+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/7811 2023-12-31 05:27:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/6343 2024-01-01 05:39:46+00:00| seen| https://t.me/arpsyndicate/2298 2024-01-01...

Introducing Active Risk

Cyber risk is increasing both in volume and velocity. Given the landscape of threats, weaknesses, vulnerabilities, and misconfigurations, organizations, teams and vulnerability analysts alike need of better prioritization mechanisms. That's why we developed a new risk scoring methodology: Active...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-28434 MinIO Security Feature Bypass Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risk...

CISA Adds Eight Known Exploited Vulnerabilities to Catalog

CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2022-22265 Samsung Mobile Devices Use-After-Free Vulnerability CVE-2014-8361 Realtek SDK Improper Input Validation Vulnerability CVE-2017-6884 Zyxel EMG2926 Route...

CVE-2023-3710

creationtimestamp| type| source ---|---|--- 2023-09-13 00:23:19+00:00| seen| https://t.me/cibsecurity/70353 2023-10-14 18:27:24+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5418 2023-10-15 06:07:45+00:00| published-proof-of-concept| https://t.me/CNArsenal/1282 2023-10-15...

CISA Adds Two Known Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability CVE-2023-36802 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability These types of...

CVE-2023-4634

creationtimestamp| type| source ---|---|--- 2023-09-05 11:57:15+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/5085 2023-09-06 09:31:08+00:00| published-proof-of-concept| https://t.me/thebugbountyhunter/7744 2023-09-06 12:17:47+00:00| seen| https://t.me/cibsecurity/69963 2023-09-07...

CVE-2023-39026

creationtimestamp| type| source ---|---|--- 2023-08-23 02:12:01+00:00| seen| https://t.me/cibsecurity/69043 2023-10-23 19:27:06+00:00| published-proof-of-concept| Telegram/X8AxNFp0HQTngPQfgKr7iAFqHeL4fj8-bjEOb-q8Rk 2023-10-24 15:05:53+00:00| published-proof-of-concept| https://t.me/CNArsenal/1351...

Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software

Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry formerly MobileIron Sentry that it said is being actively exploited in the wild, marking an escalation of its security woes. Tracked as CVE-2023-38035 CVSS score: 9.8, the issue has been described...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-24489 Citrix Content Collaboration ShareFile Improper Access Control Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber...

A week in security (August 7 - August 13)

Last week on Malwarebytes Labs: Zoom clarifies user consent requirement when training its AI Several hospitals still counting the cost of widespread ransomware attack Old exploit kits still kicking around in 2023 YouTube makes sweeping changes to tackle spam on Shorts videos Googles "browse...

CVE-2023-32563

creationtimestamp| type| source ---|---|--- 2023-08-11 00:16:14+00:00| seen| https://t.me/cibsecurity/68260 2023-08-16 19:10:04+00:00| seen| https://t.me/truesecator/4739 2023-09-03 07:06:40+00:00| published-proof-of-concept| https://t.me/CNArsenal/998 2024-10-31 00:00:00+00:00| exploited| The...