Week in review: PoC for Splunk Enterprise RCE flaw released, scope of Okta breach widens
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2023-41998+2 related CVEs | Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface | 9.8 | 15% | PoC | |
CVE-2023-42917+1 related CVE | WebKit Memory Corruption in Apple iOS, macOS, and Safari Enables Arbitrary Code Execution | 8.8 group max | 9% | KEV | KEV |
| CVE-2023-46214 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that… | 8.8 | 89% | ||
| CVE-2023-49103 | Unauthenticated phpinfo credential leak in ownCloud graphapi | 7.5 | 78% | KEV | KEV |
| CVE-2023-6345 | Integer Overflow in Google Chrome's Skia Enables Sandbox Escape (Actively Exploited) | 9.6 | 16% | KEV | KEV |
From the original article
6 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Vulnerability disclosure: Legal risks and ethical considerations for researchers In this Help Net Security interview, Eddie Zhang, Principal Consultant at Project Black, explores the complex and often controversial world of vulnerability disclosure in cybersecurity.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.