Oct 16, 2023
1 new incident, 2 with updates.
Started
- ClosedPatched
Xfinity breach via Citrix Bleed: 35.9M customers
Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.
Xfinity (Comcast)Closed Dec 18, 2023
Updated
- ClosedPatched
Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)
A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.
Atlassian Confluence Data Center and ServerClosed Oct 16, 2023
- ClosedPatched
Cisco IOS XE web UI zero-days: implants on tens of thousands of devices
Attackers chained two zero-days in the Cisco IOS XE web UI. CVE-2023-20198 let them create a privilege-15 account, and CVE-2023-20273 let them write a root-level implant. Internet scans soon found implants on tens of thousands of switches and routers.
Cisco IOS XE Software (web UI)Closed Oct 23, 2023
