Mar 14, 2023
3 new incidents, 0 with updates.
Started
- ClosedPatched
Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)
A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.
Microsoft Outlook for WindowsClosed Mar 24, 2023
- ClosedPatched
Fortinet FortiOS: Path Traversal (CVE-2022-41328)
Fortinet FortiOS contains a path traversal vulnerability that may allow a local privileged attacker to read and write files via crafted CLI commands. Added to CISA KEV on 2023-03-14.
Fortinet FortiOSClosed Mar 14, 2023
- ClosedPatched
Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)
Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Added to CISA KEV on 2023-03-14. CISA lists known use in ransomware campaigns.
Microsoft WindowsClosed Mar 14, 2023
