May 31, 2023
1 new incident, 1 with updates.
Started
- ClosedPatched
Zyxel Multiple Firewalls: OS Command Injection (CVE-2023-28771)
Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device. Added to CISA KEV on 2023-05-31.
Zyxel Multiple FirewallsClosed May 31, 2023
Updated
- ClosedPatched
MOVEit Transfer zero-day: Cl0p mass data theft
Cl0p (Lace Tempest) exploited an unauthenticated SQL injection in Progress MOVEit Transfer as a zero-day, stealing files from thousands of organisations through their managed file transfer servers. Progress shipped three rounds of fixes in June 2023 as more SQL injection bugs were found.
Progress MOVEit TransferClosed Jun 16, 2023
