Weekly briefing

Week 37 · 11 Sep – 17 Sep 2023 UTC · assess the changes, then plan the next dates.

All dated changes in this period

10 source records · 9 groups

13 Sep 2023

SecurityAndroid

Android Framework Privilege Escalation Vulnerability

Android · exploited, added to CISA KEV

CVE-2023-35674

Assessment context

CISA lists it as exploited

13 Sep 2023

SecurityCisco

Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability

Cisco · exploited, added to CISA KEV

CVE-2023-20269

Assessment context

CISA lists it as exploited, including by ransomware

13 Sep 2023

SecurityGoogle Chrome

Google Chromium WebP Heap-Based Buffer Overflow Vulnerability

Google · exploited, added to CISA KEV

CVE-2023-4863

Assessment context

CISA lists it as exploited

12 Sep 2023

SecurityMicrosoft 365 Apps

Microsoft Word Information Disclosure Vulnerability

Added to CISA KEV

CVE-2023-36761

Assessment context

CISA lists it as exploited

12 Sep 2023

SecurityMicrosoft Security Update Guide

September 2023 Security Updates

MSRC release notes · Microsoft Security Update Guide

Assessment context

Monthly security release notes

12 Sep 2023

SecurityMicrosoft Streaming Service Proxy Privilege Escalation Vulnerability

Microsoft Streaming Service Proxy Privilege Escalation Vulnerability

Added to CISA KEV

CVE-2023-36802

Assessment context

CISA lists it as exploited

12 Sep 2023

SecurityGitLab2 source records

Security advisory · 2 entries

GitLab Patch Release: 16.2.6
Security advisory · GitLab patch releases
GitLab Patch Release: 16.3.3
Security advisory · GitLab patch releases

11 Sep 2023

SecurityiOS and iPadOS / macOS

Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability

Apple · exploited, added to CISA KEV

CVE-2023-41064

Assessment context

CISA lists it as exploited

11 Sep 2023

SecurityiOS and iPadOS

Apple iOS, iPadOS, and watchOS Wallet Code Execution Vulnerability

Apple · exploited, added to CISA KEV

CVE-2023-41061

Assessment context

CISA lists it as exploited

Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.