CVE Vulnerability Advisory Database

[Affected Scope] iOS/iPadOS 15 and 16, macOS Ventura, watchOS, tvOS, and Safari versions prior to 16.5

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE), and Apple is aware of active exploitation in the wild

[Mitigation] Immediately update operating systems and Safari to the latest patched versions using Apple's official software update mechanism

[Affected Scope] Systems running unpatched versions impacted by CVE-2023-29360

[Impact] Microsoft Streaming Service Elevation of Privilege Vulnerability...

[Mitigation] Apply vendor security patches and restrict external network exposure.

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 114.0.5735.110

[Impact] A remote attacker can trigger heap corruption and potentially execute arbitrary code by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (114.0.5735.110 or higher) and enforce automatic update policies

[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server 2016/2019/2022 utilizing the Win32k kernel driver.

[Impact] A local attacker can exploit a Use-After-Free (UAF) vulnerability to corrupt kernel memory, leading to arbitrary code execution with SYSTEM privileges.

[Mitigation] Immediately apply the official Microsoft Cumulative Updates (LCU) and enhance monitoring for Indicators of Compromise (IoCs).

[Affected Scope] Samsung Android mobile devices running firmware versions prior to the SMR May-2023 Release 1 security update

[Impact] A privileged local attacker can read exposed kernel pointers in system log files to bypass ASLR (Address Space Layout Randomization), facilitating subsequent kernel-level code execution

[Mitigation] Apply the Samsung May 2023 security update (SMR May-2023 Release 1) or later, and restrict access to sensitive system logs

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 112.0.5615.137

[Impact] A remote attacker who has compromised the renderer process can potentially perform a sandbox escape and execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (112.0.5615.137 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 112.0.5615.121

[Impact] Remote attackers can exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution (RCE) within the browser process

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (112.0.5615.121 or higher)

[Affected Scope] Windows 10, 11, and Windows Server 2008, 2012, 2016, 2019, 2022 utilizing the clfs.sys driver

[Impact] Local attackers can execute arbitrary code with SYSTEM privileges, fully compromising the host and disabling security controls

[Mitigation] Apply the Microsoft April 2023 security updates immediately, or restrict .blf file creation permissions as a temporary workaround

[Affected Scope] Windows 10, 11, and Windows Server deployments running the CNG Key Isolation (KeyIso) service

[Impact] Local authenticated attackers with low privileges can execute arbitrary code with SYSTEM privileges by running a specially crafted application

[Mitigation] Apply the latest Microsoft Cumulative Updates (LCU) immediately and restrict unauthorized local access

[Affected Scope] iOS and iPadOS versions prior to 15.7.5 / 16.4.1, macOS Big Sur prior to 11.7.6, Monterey prior to 12.6.5, and Ventura prior to 13.3.1

[Impact] A local application can execute arbitrary code with kernel privileges, leading to complete system compromise. This vulnerability is actively exploited in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (e.g., iOS 16.4.1, macOS 13.3.1)

[Affected Scope] Systems running Safari prior to 16.4.1, iOS/iPadOS prior to 15.7.5 and 16.4.1, and macOS Ventura prior to 13.3.1

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution due to a Use-After-Free memory corruption issue, which has been actively exploited in the wild

[Mitigation] Immediately apply the official security updates and OS patches provided by Apple

[Affected Scope] ARM Mali GPU Kernel Drivers (Midgard r6p0-r32p0, Bifrost r0p0-r42p0, Valhall r19p0-r42p0, Avalon r41p0-r42p0)

[Impact] A local non-privileged user can perform valid GPU processing operations to expose sensitive kernel metadata, facilitating KASLR bypass and local privilege escalation (LPE)

[Mitigation] Apply official security patches from chipset vendors and OEMs, and immediately upgrade device firmware to the latest version

[Affected Scope] Android operating system versions 11, 12, 12L, and 13

[Impact] Local attackers can escalate privileges to the SYSTEM level without any user interaction or additional execution privileges

[Mitigation] Immediately update the system to the March 2023 Android Security Patch Level (2023-03-01) or later

[Affected Scope] Cobalt Strike version 4.7.1

[Impact] Remote attackers can execute arbitrary code within the Cobalt Strike UI context by injecting crafted HTML payloads

[Mitigation] Immediately upgrade to Cobalt Strike version 4.7.2 or later, and restrict access to the Teamserver

[Affected Scope] Systems and container environments utilizing the Linux kernel OverlayFS subsystem

[Impact] A local attacker can escalate privileges to root by copying a setuid/capable file from a nosuid mount into another mount

[Mitigation] Apply the latest kernel security patches from your distribution or restrict unprivileged user namespaces as a temporary workaround

[Affected Scope] All supported versions of Windows 10, Windows 11, and Windows Server

[Impact] Attackers can bypass Mark of the Web (MotW) warnings and Windows SmartScreen blocks using specially crafted signatures, leading to silent malware execution

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or restrict untrusted file execution using AppLocker/WDAC policies

[Affected Scope] All supported desktop versions of Microsoft Outlook for Windows, including Outlook 2013, 2016, LTSC 2021, and Microsoft 365 Apps

[Impact] Attackers can trigger the vulnerability silently without user interaction (Zero-Click) simply by sending a malicious email, leaking the user's NTLM hash to external servers for NTLM relay attacks

[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB traffic (TCP port 445) at the perimeter, and run the Exchange audit script to purge malicious items

[Affected Scope] All deployments of Veeam Backup & Replication versions 11 and 12 (prior to patched builds).

[Impact] Unauthenticated remote attackers can obtain encrypted credentials stored in the configuration database, potentially gaining full access to backup infrastructure hosts.

[Mitigation] Apply the official security patches immediately, or restrict access to the Veeam Backup Service port (TCP 9401) using firewall rules.

[Affected Scope] Apple devices running iOS versions prior to 16.3.1, iPadOS versions prior to 16.3.1, macOS Ventura versions prior to 13.2.1, and Safari versions prior to 16.3

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE). This vulnerability has been actively exploited in the wild

[Mitigation] Immediately apply the official security updates provided by Apple to upgrade to patched versions

[Affected Scope] All Windows systems utilizing the Windows Graphics component, including Windows 10, Windows 11, and Windows Server 2008-2022

[Impact] Local attackers can exploit an integer overflow (CWE-190) to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft security updates immediately and ensure Windows Graphics-related Store apps are updated to their latest versions