Sep 18, 2023
3 new incidents, 1 with updates.
Started
- ClosedCriticalPatched
Cisco IOS XE web UI zero-days: implants on tens of thousands of devices
Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.
Cisco IOS XE Software (web UI)Closed Oct 23, 2023
- ClosedCriticalPatched
TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.
JetBrains TeamCity On-PremisesClosed Dec 13, 2023
- ClosedHighPatched
Samsung Mobile Devices: Use-After-Free (CVE-2022-22265)
Samsung devices with selected Exynos chipsets contain a use-after-free vulnerability that allows malicious memory write and code execution. Added to CISA KEV on 2023-09-18.
Samsung Mobile DevicesClosed Sep 18, 2023
Updated
- ClosedHighPatched
Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link
A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.
Microsoft Azure Storage (SAS token in a GitHub repo)Closed Sep 18, 2023
