Oct 4, 2023
2 new incidents, 1 with updates.
Started
- ClosedPatched
Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)
A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.
Atlassian Confluence Data Center and ServerClosed Oct 16, 2023
- ClosedPatched
Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)
Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Added to CISA KEV on 2023-10-04.
Microsoft Windows CNG Key Isolation ServiceClosed Oct 4, 2023
Updated
- ClosedPatched
TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.
JetBrains TeamCity On-PremisesClosed Dec 13, 2023
