CVE Vulnerability Advisory Database

[Affected Scope] Microsoft Windows operating systems including Windows 10, 11, and Windows Server 2016, 2019, 2022 utilizing the CLFS driver

[Impact] A local attacker with low privileges can execute arbitrary code in kernel mode, leading to complete system takeover with SYSTEM privileges

[Mitigation] Immediately apply the official Microsoft cumulative security updates (February 2023 Patch Tuesday) and monitor unpatched assets

[Affected Scope] Microsoft Office and Microsoft Publisher 2013, 2016, 2019, 2021, and Microsoft 365 Apps

[Impact] Attackers can bypass Office macro blocking policies (Mark of the Web) via specially crafted Publisher files to execute arbitrary code

[Mitigation] Apply official Microsoft security patches immediately and enforce registry policies to disable Publisher macros

[Affected Scope] Systems running Linux Kernel utilizing the ALSA (Advanced Linux Sound Architecture) PCM subsystem

[Impact] A local attacker can trigger a Use-After-Free (UAF) condition to corrupt kernel memory, leading to complete system compromise with Ring 0 privileges

[Mitigation] Upgrade the Linux kernel past commit 56b88b50565cd8b946a2d00b0c83927b7ebb055e, or blacklist the vulnerable sound modules

[Affected Scope] Adobe Acrobat and Reader versions 22.003.20282 (and earlier), 22.003.20281 (and earlier), and 20.005.30418 (and earlier)

[Impact] Successful exploitation could lead to arbitrary code execution in the context of the current user when a victim opens a crafted malicious PDF

[Mitigation] Immediately apply the official Adobe security patches to upgrade to the latest secure versions

[Affected Scope] Microsoft Windows operating systems including Windows 10, Windows 11, and Windows Server 2016/2019/2022 utilizing the ALPC mechanism

[Impact] Successful exploitation allows a local attacker to bypass sandbox environments, elevate privileges to SYSTEM, and execute arbitrary code to fully compromise the host

[Mitigation] Immediately apply the official Microsoft cumulative security updates released in January 2023 or later

[Affected Scope] Apple WebKit engine in Safari prior to 16.2, tvOS prior to 16.2, macOS Ventura prior to 13.1, iOS prior to 15.7.2/16.1.2, and iPadOS prior to 15.7.2

[Impact] Processing maliciously crafted web content may lead to arbitrary code execution (RCE) on the target system, with active exploitation observed in the wild

[Mitigation] Immediately update affected Apple operating systems and Safari browsers to the latest patched versions (iOS 16.2, macOS 13.1, or later)

[Affected Scope] Windows 10, 11, and Windows Server 2016, 2019, 2022

[Impact] Attackers can bypass Windows SmartScreen and Mark of the Web (MotW) warnings, leading to unauthorized execution of malicious files without user alerts

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately and enforce strict SmartScreen policies via GPO

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 108.0.5359.94

[Impact] A remote attacker can exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution within the browser process

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (108.0.5359.94 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 107.0.5304.121

[Impact] A remote attacker who has compromised the renderer process can bypass the browser sandbox and potentially execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (107.0.5304.121 or higher)

[Affected Scope] Windows systems running Audinate Dante Discovery services and utilizing the mDNSResponder.exe component

[Impact] Local attackers can leverage the legitimate, signed executable to load malicious DLLs, leading to arbitrary code execution with elevated privileges

[Mitigation] Apply official security patches from Audinate, restrict write permissions on the mDNSResponder execution directory, and monitor for unauthorized DLL loads

[Affected Scope] Windows client and server environments utilizing the Windows Scripting Engine (JScript9)

[Impact] Successful exploitation allows remote attackers to execute arbitrary code with the privileges of the active user via crafted web content or documents

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict the execution of legacy JScript engines

[Affected Scope] Microsoft Windows operating systems including Windows 10, 11, and Windows Server 2012, 2016, 2019, 2022 utilizing the CNG Key Isolation service

[Impact] A local authenticated attacker can execute arbitrary code with SYSTEM privileges by running a specially crafted application, leading to complete system compromise

[Mitigation] Apply the official Microsoft Latest Cumulative Update (LCU) immediately and restrict local logon privileges for non-administrative users

[Affected Scope] Microsoft Windows operating systems, including Windows 10, 11, and Windows Server editions

[Impact] Attackers can bypass the Mark of the Web (MotW) security warning, allowing malicious files to execute without triggering SmartScreen alerts

[Mitigation] Apply the official Microsoft cumulative security updates immediately and restrict execution of untrusted files

[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with the Print Spooler service enabled

[Impact] A local authenticated attacker can exploit this vulnerability to execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing server infrastructures

[Affected Scope] Microsoft Windows operating systems, including Windows 10, 11, and Windows Server editions

[Impact] Files downloaded from the internet may bypass the 'Mark of the Web (MotW)' flag, allowing malicious payloads to execute without SmartScreen warnings or Office Protected View restrictions

[Mitigation] Apply the latest Microsoft Cumulative Updates immediately, and restrict the extraction of untrusted archives (ZIP, ISO) until patched

[Affected Scope] Netwrix Auditor server and User Activity Video Recording agents installed on monitored systems

[Impact] Unauthenticated remote attackers can execute arbitrary code with 'NT AUTHORITY\SYSTEM' privileges on affected servers and monitored hosts

[Mitigation] Immediately upgrade Netwrix Auditor to the latest secure version and restrict network access to agent communication ports

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 107.0.5304.87

[Impact] A remote attacker can potentially exploit heap corruption via a crafted HTML page, leading to arbitrary remote code execution (RCE) within the browser renderer process

[Mitigation] Immediately update Google Chrome to the latest stable version (107.0.5304.87 or higher) and enforce automatic updates across enterprise environments

[Affected Scope] Apple devices running iOS and iPadOS versions prior to 15.7.1 or 16.1

[Impact] A local application can exploit this vulnerability to execute arbitrary code with kernel privileges, leading to complete device compromise. Active exploitation has been reported in the wild

[Mitigation] Immediately update affected devices to iOS/iPadOS 15.7.1, iOS 16.1, or later versions

[Affected Scope] Android and embedded devices utilizing Arm Mali GPU Bifrost (r0p0 to r38p1, r39p0), Valhall (r19p0 to r38p1, r39p0), and Midgard (r4p0 to r32p0) drivers

[Impact] Local unprivileged attackers can exploit a Use-After-Free (UAF) condition in GPU memory operations to gain arbitrary kernel code execution and full root privileges

[Mitigation] Apply the latest security patches provided by chipset vendors and OEMs, and immediately upgrade vulnerable driver versions

[Affected Scope] Windows 7, 8.1, 10, 11 and Windows Server 2008, 2012, 2016, 2019, 2022 with active Print Spooler service

[Impact] Local authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to complete system compromise

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or disable the Print Spooler service on non-printing servers