Jul 11, 2023
3 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
Netwrix Auditor: Insecure Object Deserialization (CVE-2022-31199)
Netwrix Auditor User Activity Video Recording component contains an insecure objection deserialization vulnerability that allows an unauthenticated, remote attacker to execute code as the NT AUTHORITY\SYSTEM user. Successful exploitation requires that the attacker is able to reach port 9004/TCP, which is commonly blocked by standard enterprise firewalling. Added to CISA KEV on 2023-07-11. CISA lists known use in ransomware campaigns.
Netwrix AuditorClosed Jul 11, 2023
- ClosedHighPatched
Microsoft Outlook: Security Feature Bypass (CVE-2023-35311)
Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. Added to CISA KEV on 2023-07-11.
Microsoft OutlookClosed Jul 11, 2023
- ClosedHighPatched
Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)
Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-07-11.
Microsoft WindowsClosed Jul 11, 2023
Updated
- ClosedCriticalPatched
Storm-0558: stolen Microsoft signing key used to read government email
China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.
Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)Closed Sep 6, 2023
