Overview NSFOCUS CERT recently monitored that Microsoft had released a security update patch for April, which fixed 97 security issues, involving Microsoft Word, Layer2 Tunneling Protocol, Microsoft Publisher, Windows Kernel and other widely used products, including high-risk vulnerability types such as privilege escalation and remote code execution. Among the vulnerabilities...
Category: Emergency Response
Multiple Security Vulnerability Notification on Apple Products
Overview Recently, NSFOCUS CERT has detected that Apple has officially fixed the security vulnerabilities of several products. Please take protective measures as soon as possible. The details of the vulnerability are as follows: Apple IOSurfaceAccelerator privilege escalation vulnerability (CVS 2023-28206): There is an out of bounds write vulnerability in Apple...
Sudo Permission Elevation Vulnerability (CVE-2023-22809) Notification
Overview Recently, NSFOCUS CERT found that the analysis article and ExP of Sudo privilege enhancement vulnerability (CVE-2023-22809) were publicly disclosed online. Since sudoedit in Sudo has a flaw in handling additional parameters passed in user provided environment variables such as SUDO_EDITOR, VISUAL, and EDITOR., when a user specified editor contains...
MiniO Information Disclosure Vulnerability (CVE-2023-28432) Notification
Overview Recently, NSFOCUS CERT found that MinIO officially issued a security notice, which fixed a MinIO information disclosure vulnerability (CVE-2023-28432). When MiniO is configured in cluster mode, an unauthenticated attacker can ultimately obtain information about all environment variables by constructing a crafted request packet, which allows the attacker to utilize...
Adobe ColdFusion Multiple Security Vulnerabilities Notification
Vulnerability Overview Recently, NSFOCUS CERT monitored that Adobe has officially released security notices and fixed multiple Adobe ColdFusion vulnerabilities. Please take protective measures as soon as possible. Key vulnerabilities are as follows: Adobe ColdFusion deserialization vulnerability (CVE-2023-26359): Due to a flaw in Adobe ColdFusion's deserialization security check, unauthenticated remote attackers...
Microsoft Outlook Privilege Escalation Vulnerability (CVE-2023-23397) Notification
Overview Recently, NSFOCUS CERT has monitored that Microsoft has officially released a patch update, which fixes a Microsoft Outlook privilege escalation vulnerability. An unauthenticated attacker sends a specially crafted email, causing the victim to connect to an external UNC location controlled by the attacker, causing the victim's Net-NTLMv2 hash to...
