Exploit / PoCcritical
It’s a hot 0-day summer for Apple, Google, and Microsoft security fixes
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-29256 | Use-After-Free in Arm Mali GPU Kernel Driver Allows Root Privilege Escalation | 8.8 | 3% | KEV | KEV |
| CVE-2023-20862 | In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean… | 6.3 | <1% | ||
| CVE-2023-2136 | Skia Integer Overflow Sandbox Escape in Google Chrome | 9.6 | 6% | KEV | KEV |
| CVE-2023-26083 | Memory Leak Information Disclosure in Arm Mali GPU Kernel Drivers | 3.3 | 1% | KEV | KEV |
CVE-2023-32049+3 related CVEs | Windows SmartScreen Security Feature Bypass Exploited in the Wild (CVE-2023-32049) | 8.8 group max | 4% | KEV | KEV |
| CVE-2023-33987 | An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88… | 9.4 | <1% | ||
| CVE-2023-33989 | An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to… | 8.1 | <1% | ||
| CVE-2023-3519 | Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway | 9.8 | 100% | KEVRansomwarePoC | KEV |
| CVE-2023-36922 | Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary… | 8.8 | <1% | ||
CVE-2023-37201+3 related CVEs | An attacker could have triggered a use-after-free condition when creating a WebRTC connection over HTTPS | 8.8 | <1% | ||
CVE-2023-3732+3 related CVEs | Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer process to potentially… | 8.8 | 1% | ||
| CVE-2023-37450 | Arbitrary Code Execution in Apple WebKit (iOS, iPadOS, macOS, Safari, tvOS, watchOS) | 8.8 | 19% | KEV | KEV |
From the original article
5 min read at arstechnica.com
July saw two high-severity bugs in Firefox, while Oracle patched over 500 vulnerabilities. The summer patch cycle shows no signs of slowing down, with tech giants Apple, Google, and Microsoft releasing multiple updates to fix flaws being used in real-life attacks. July also saw serious bugs squashed by enterprise software firms SAP, Citrix, and Oracle.
arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.