Nov 16, 2023

Started

• ClosedCritical✓Patched

  Sophos Web Appliance: Command Injection (CVE-2023-1671)

  Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Added to CISA KEV on 2023-11-16.

  Sophos Web Appliance·Closed Nov 16, 2023·updated Nov 16, 2023

• ClosedMedium✓Patched

  Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)

  Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Added to CISA KEV on 2023-11-16.

  Microsoft Windows·Closed Nov 16, 2023·updated Nov 16, 2023

Updated

• ClosedHigh✓Patched

  Xfinity breach via Citrix Bleed: 35.9M customers

  Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

  Xfinity (Comcast)·Closed Dec 18, 2023·updated Dec 18, 2023