Jan 8, 2024
6 new incidents, 0 with updates.
Started
- ClosedPatched
Adobe ColdFusion: 2 actively exploited vulnerabilities
CVE-2023-29300: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. CVE-2023-38203: Adobe ColdFusion contains a deserialization of untrusted data vulnerability that allows for code execution. Added to the CISA KEV catalog on 2024-01-08. CISA lists known use in ransomware campaigns. CVE-2023-29300, CVE-2023-38203 were assigned before 2024; the KEV listing came in 2024.
Adobe ColdFusionClosed Jan 8, 2024
- ClosedPatched
D-Link DSL-2750B Devices Command Injection
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Added to the CISA KEV catalog on 2024-01-08. CVE-2016-20017 was assigned before 2024; the KEV listing came in 2024.
D-Link DSL-2750B DevicesClosed Jan 8, 2024
- ClosedPatched
Apache Superset Insecure Default Initialization of Resource
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-27524 was assigned before 2024; the KEV listing came in 2024.
Apache SupersetClosed Jan 8, 2024
- ClosedPatched
Apple Multiple Products Code Execution
Apple iOS, iPadOS, macOS, tvOS, and watchOS contain an unspecified vulnerability that allows for code execution when processing a font file. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-41990 was assigned before 2024; the KEV listing came in 2024.
Apple Multiple ProductsClosed Jan 8, 2024
- ClosedPatched
Joomla! Improper Access Control
Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. Added to the CISA KEV catalog on 2024-01-08. CVE-2023-23752 was assigned before 2024; the KEV listing came in 2024.
Joomla!Closed Jan 8, 2024
- ClosedPatched
Linux Kernel Use-After-Free
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges. Added to the CISA KEV catalog on 2024-06-26. CVE-2022-2586 was assigned before 2024; the KEV listing came in 2024.
Linux KernelClosed Jun 26, 2024
