Oct 10, 2023

Started

• Closed✓Patched

  Citrix Bleed: NetScaler session token leak (CVE-2023-4966)

  A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).

  Citrix NetScaler ADC and NetScaler Gateway·Closed Nov 21, 2023·updated Dec 18, 2023

• Closed✓Patched

  Adobe Acrobat and Reader: Use-After-Free (CVE-2023-21608)

  Adobe Acrobat and Reader contains a use-after-free vulnerability that allows for code execution in the context of the current user. Added to CISA KEV on 2023-10-10.

  Adobe Acrobat and Reader·Closed Oct 10, 2023·updated Oct 10, 2023

• Closed✓Patched

  Cisco IOS and IOS XE: Group Encrypted Transport VPN Out-of-Bounds Write (CVE-2023-20109)

  Cisco IOS and IOS XE contain an out-of-bounds write vulnerability in the Group Encrypted Transport VPN (GET VPN) feature that could allow an authenticated, remote attacker who has administrative control of either a group member or a key server to execute malicious code or cause a device to crash. Added to CISA KEV on 2023-10-10.

  Cisco IOS and IOS XE·Closed Oct 10, 2023·updated Oct 10, 2023

• Closed✓Patched

  Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)

  Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-10-10.

  Microsoft Skype for Business·Closed Oct 10, 2023·updated Oct 10, 2023

• Closed✓Patched

  Microsoft WordPad: Information Disclosure (CVE-2023-36563)

  Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure. Added to CISA KEV on 2023-10-10.

  Microsoft WordPad·Closed Oct 10, 2023·updated Oct 10, 2023

Updated

• Closed✓Patched

  HTTP/2 Rapid Reset: record-breaking DDoS attacks (CVE-2023-44487)

  Attackers abused HTTP/2 stream cancellation (open a request, reset it right away, repeat) to make servers do work at enormous rates. Peaks hit 398M req/s at Google, 201M at Cloudflare and 155M at AWS. Almost every HTTP/2 server and proxy needed a fix, including Node.js, Go, Java servers, .NET/IIS and nginx.

  HTTP/2 protocol implementations (servers, proxies, CDNs)·Closed Oct 10, 2023·updated Oct 10, 2023