Zero-day report: January 2023
CISA added 5 exploited vulnerabilities to its catalog in January 2023, 4 fewer than December (9). 2 were zero-days, listed within a week of going public. 3 are known to be used by ransomware. The most-hit vendor was Microsoft, with 2.
By technology
Most-hit vendors
Every flaw added in January 2023
- Telerik · User Interface (UI) for ASP.NET AJAXTelerik UI for ASP.NET AJAX Insecure Direct Object Reference Vulnerability
- Zoho · ManageEngineZoho ManageEngine Multiple Products Remote Code Execution Vulnerability
- CWP · Control Web PanelCWP Control Web Panel OS Command Injection Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability
← December 2022February 2023 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.