CVE Vulnerability Advisory Database

[Affected Scope] Broad range of Microsoft Office products including Microsoft Word 2013, 2016, 2019, 2021, and Microsoft 365 Apps

[Impact] Attackers can force the victim's system to leak NTLM credentials (hashes) to an external malicious server simply by having the victim select or preview a crafted document in the Preview Pane

[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB (TCP 445) traffic at the perimeter, and restrict outbound NTLM authentication via Group Policy

[Affected Scope] Apple iOS/iPadOS prior to 15.7.8 and 16.3, macOS Monterey prior to 12.6.8, macOS Big Sur prior to 11.7.9, macOS Ventura prior to 13.2, tvOS prior to 16.3, and watchOS prior to 9.3

[Impact] Processing a maliciously crafted font file may lead to arbitrary code execution (RCE) with system privileges, and active exploitation in the wild has been reported

[Mitigation] Immediately update all affected Apple devices to the latest patched OS versions (iOS 15.7.8 / 16.3, macOS 12.6.8 / 11.7.9 / 13.2 or later)

[Affected Scope] Android OS System Framework

[Impact] Local attackers can bypass background activity launch restrictions to execute arbitrary activities without user interaction, leading to local privilege escalation

[Mitigation] Apply the Google Android September 2023 Security Patch or update to the latest vendor-provided firmware immediately

[Affected Scope] Apple iOS and iPadOS prior to 16.6.1, macOS Monterey prior to 12.6.9, macOS Ventura prior to 13.5.2, iOS/iPadOS prior to 15.7.9, and macOS Big Sur prior to 11.7.10

[Impact] Processing a maliciously crafted image can trigger a buffer overflow, leading to arbitrary code execution (RCE) and potential system takeover

[Mitigation] Immediately apply the official security updates (iOS 16.6.1, macOS 13.5.2, etc.) and consider enabling Lockdown Mode for high-risk environments

[Affected Scope] Apple iOS devices prior to 16.6.1, iPadOS devices prior to 16.6.1, and watchOS devices prior to 9.6.2

[Impact] A maliciously crafted attachment can bypass validation logic, allowing attackers to execute arbitrary code with system privileges without user interaction

[Mitigation] Immediately update affected devices to iOS 16.6.1, iPadOS 16.6.1, watchOS 9.6.2, or later versions

[Affected Scope] Google Chrome and Chromium-based browsers (such as Microsoft Edge) prior to version 116.0.5845.179

[Impact] A remote attacker can execute arbitrary code and compromise the target system by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update your browser to the latest stable version (116.0.5845.179 or higher)

[Affected Scope] All Windows endpoint environments running RARLAB WinRAR versions prior to 6.23.

[Impact] Attackers can execute arbitrary code in the background when a user attempts to open a seemingly benign file within a crafted ZIP archive, leading to full system compromise.

[Mitigation] Immediately upgrade WinRAR to version 6.23 or higher, and restrict execution of untrusted archive files.

[Affected Scope] Apple iOS/iPadOS prior to 15.6, macOS Monterey prior to 12.5, Safari prior to 15.6, watchOS prior to 8.7, and tvOS prior to 15.6

[Impact] Processing maliciously crafted web content may allow remote attackers to execute arbitrary code on the target system

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to patched versions

[Affected Scope] Apple iOS and iPadOS prior to 15.7.8 / 16.6, macOS Big Sur prior to 11.7.9, macOS Monterey prior to 12.6.8, macOS Ventura prior to 13.5, tvOS prior to 16.6, and watchOS prior to 9.6

[Impact] A local application can bypass kernel memory protections and modify sensitive kernel states, leading to complete system compromise and arbitrary code execution

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 15.7.8 / 16.6, macOS 13.5, etc.) and enforce updates via MDM

[Affected Scope] Apple iOS before 16.6, iPadOS before 16.6, macOS Ventura before 13.5, Safari before 16.5.2, tvOS before 16.6, and watchOS before 9.6

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) within the sandbox context, and this vulnerability has been actively exploited in the wild

[Mitigation] Immediately apply the official software updates provided by Apple to patch the operating systems and Safari browser

[Affected Scope] All endpoint systems running Microsoft Windows and Microsoft Office suites

[Impact] Remote attackers can execute arbitrary code with system privileges via specially crafted documents, leading to full system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement the registry-based workaround

[Affected Scope] Most major versions of Windows operating systems, including Windows 10, 11, and Windows Server 2008 through 2022

[Impact] A local authenticated attacker with low privileges can manipulate file system links to execute arbitrary code with SYSTEM privileges, leading to full system compromise

[Mitigation] Immediately apply the latest cumulative security updates provided by Microsoft, or temporarily disable the WER service and restrict file link creation privileges

[Affected Scope] Broad range of Microsoft Office products including Microsoft Outlook 2013, 2016, 2019, 2021, and Microsoft 365 Apps for Enterprise

[Impact] Attackers can bypass Outlook security warning prompts via specially crafted links, potentially leading to subsequent Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Microsoft security patches and restrict untrusted link execution via Group Policy (GPO) or registry hardening

[Affected Scope] All supported versions of Windows Operating Systems, including Windows 10, Windows 11, and Windows Server

[Impact] Attackers can bypass the Windows SmartScreen warning dialog when executing downloaded malicious files, leading to immediate code execution without user consent

[Mitigation] Apply the latest Microsoft cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] Windows client and server operating systems utilizing the MSHTML platform

[Impact] Attackers can bypass security boundaries (including AppContainer restrictions) and execute arbitrary code with the privileges of the logged-in user by tricking them into opening crafted files

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict opening untrusted email attachments or web links

[Affected Scope] Android 13 operating system (Android-13, Android ID: A-251586912)

[Impact] Attackers can hide mandatory foreground service notifications without user interaction, enabling stealthy background execution and unauthorized local information disclosure

[Mitigation] Apply the official June 2023 (or later) Android security patch and restrict notification permissions for untrusted applications

[Affected Scope] Systems running iOS/iPadOS prior to 16.5.1, iOS/iPadOS prior to 15.7.7, macOS Ventura prior to 13.4.1, and Safari prior to 16.5.1

[Impact] Processing maliciously crafted web content may lead to memory corruption, allowing remote attackers to execute arbitrary code on the target device

[Mitigation] Immediately apply the official software updates provided by Apple to patch the operating system and Safari browser

[Affected Scope] iOS versions prior to 15.7.7 and 16.4, iPadOS prior to 15.7.7 and 16.4, macOS Ventura prior to 13.3, and Safari prior to 16.4

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution and complete system compromise

[Mitigation] Immediately apply official Apple software updates to secure versions (iOS 15.7.7/16.4, macOS Ventura 13.3, etc.)

[Affected Scope] Systems running iOS/iPadOS prior to 15.7.7 and 16.5.1, macOS Big Sur/Monterey/Ventura prior to specific patched releases, and watchOS prior to 8.8.1 and 9.5.2

[Impact] A local application can exploit this vulnerability to execute arbitrary code with kernel privileges, leading to complete system compromise. Active exploitation has been reported in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (e.g., iOS 16.5.1, macOS 13.4.1)

[Affected Scope] iOS/iPadOS 15 and 16, macOS Ventura, watchOS, tvOS, and Safari versions prior to 16.5

[Impact] A remote attacker can bypass the Web Content sandbox and potentially execute arbitrary code on the host system due to a bounds check validation flaw, which is actively exploited in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 16.5, macOS 13.4, Safari 16.5, etc.)