Nov 21, 2023
0 new incidents, 2 with updates.
Updated
- ClosedPatched
Citrix Bleed: NetScaler session token leak (CVE-2023-4966)
A memory leak in NetScaler ADC and Gateway let attackers read session tokens and hijack logged-in sessions, bypassing passwords and MFA. It was exploited as a zero-day from late August 2023, then widely by LockBit affiliates. Victims included Xfinity (35.9M users).
Citrix NetScaler ADC and NetScaler GatewayClosed Nov 21, 2023
- ClosedPatched
Looney Tunables: glibc ld.so local root on most Linux distros (CVE-2023-4911)
A buffer overflow in glibc's dynamic loader, triggered through the GLIBC_TUNABLES environment variable, gave local users root through SUID binaries on default installs of Fedora, Ubuntu and Debian. Cloud attackers such as Kinsing were soon using it.
GNU C Library (glibc) ld.soClosed Nov 21, 2023
