High

Vulnerabilities

High 7.8KEVCVE-2023-41064 · CVE-2023-41061

Apple Swiftly Addresses Zero-Day Vulnerabilities Exploited for Pegasus Spyware Targeting iPhones

Apple fixed two zero-days, CVE-2023-41061 and CVE-2023-41064, used in the BLASTPASS zero-click iMessage chain to deliver Pegasus spyware.

Comments Off on Apple Swiftly Addresses Zero-Day Vulnerabilities Exploited for Pegasus Spyware Targeting iPhones

September 8, 2023

Vulnerabilities

High 8.8KEVCVE-2023-28432 · CVE-2023-28434

Attackers Exploit MinIO Storage Flaws to Breach Servers

Attackers are chaining two MinIO flaws, including KEV-listed CVE-2023-28432, to steal admin credentials and swap in a backdoored MinIO binary.

Comments Off on Attackers Exploit MinIO Storage Flaws to Breach Servers

September 4, 2023

Vulnerabilities

High 7.5KEVCVE-2023-36884

Microsoft’s August 2023 Patch Tuesday Fixes 74 Vulnerabilities

Microsoft's August 2023 updates fix 74 flaws, including Office and Windows HTML RCE CVE-2023-36884, exploited by the RomCom group.

Comments Off on Microsoft’s August 2023 Patch Tuesday Fixes 74 Vulnerabilities

August 9, 2023

Vulnerabilities

High 7.8CVE-2023-2640 · CVE-2023-32629

GameOver(lay): Ubuntu Kernel Flaws Affect 40% of Ubuntu Users

Two OverlayFS flaws unique to Ubuntu kernels (CVE-2023-2640, CVE-2023-32629) let local users gain root. Ubuntu released fixes on July 24, 2023.

Comments Off on GameOver(lay): Ubuntu Kernel Flaws Affect 40% of Ubuntu Users

July 28, 2023

Vulnerabilities

High 7.8CVE-2023-26077 · CVE-2023-26078

Zero-Day Flaws in Atera Windows Installers Allow Privilege Escalation

Two flaws in Atera agent installers for Windows (CVE-2023-26077, CVE-2023-26078) let standard users gain SYSTEM privileges. Update to 1.8.4.9.

Comments Off on Zero-Day Flaws in Atera Windows Installers Allow Privilege Escalation

July 24, 2023

Vulnerabilities

High 7.5CVE-2023-34000

Critical Security Vulnerability in WooCommerce Stripe Gateway

An unauthenticated IDOR flaw in WooCommerce Stripe Gateway 7.4.0 and earlier (CVE-2023-34000) exposes customers' names, emails and addresses. Update to 7.4.1.

Comments Off on Critical Security Vulnerability in WooCommerce Stripe Gateway

June 21, 2023

Vulnerabilities

High 8.8KEVCVE-2023-23529 · CVE-2023-23514

Apple Patches New Zero-Day Flaw Across iOS, macOS and Safari

Apple patched an exploited WebKit type confusion zero-day (CVE-2023-23529) and a kernel use-after-free in iOS 16.3.1, macOS 13.2.1 and Safari 16.3.1.

Comments Off on Apple Patches New Zero-Day Flaw Across iOS, macOS and Safari

February 28, 2023