Oct 18, 2023
0 new incidents, 4 with updates.
Updated
- ClosedPatched
Citrix Bleed: NetScaler session token leak (CVE-2023-4966)
A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).
Citrix NetScaler ADC and NetScaler GatewayClosed Nov 21, 2023
- ClosedHighNo fix needed
Okta support system breach: HAR files with session tokens stolen
An attacker used a stolen service account to get into Okta's customer support system and download files from 134 customers. Some were HAR files with live session tokens, which were used to hijack the Okta sessions of 5 customers, including BeyondTrust, Cloudflare and 1Password. Okta later found the attacker also downloaded the names and emails of all support system users.
Okta Help Center (customer support system)Closed Nov 29, 2023
- ClosedPatched
TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)
An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.
JetBrains TeamCity On-PremisesClosed Dec 13, 2023
- ClosedPatched
WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)
WinRAR before 6.23 would run hidden code when a user opened what looked like a harmless file inside a ZIP. Group-IB found it exploited since April 2023 to target traders. After the fix, Google TAG saw Russian and Chinese government-backed groups pile on.
RARLAB WinRARClosed Oct 18, 2023
