Zero-day report: February 2023
CISA added 14 exploited vulnerabilities to its catalog in February 2023, 9 more than January (5). 7 were zero-days, listed within a week of going public. 9 are known to be used by ransomware. The most-hit vendor was Microsoft, with 3.
By technology
Most-hit vendors
Every flaw added in February 2023
- ZK Framework · AuUploaderZK Framework AuUploader Unspecified Vulnerability
- Mitel · MiVoice ConnectMitel MiVoice Connect Command Injection Vulnerability
- Mitel · MiVoice ConnectMitel MiVoice Connect Code Injection Vulnerability
- IBM · Aspera FaspexIBM Aspera Faspex Code Execution Vulnerability
- Cacti · CactiCacti Command Injection Vulnerability
- Microsoft · OfficeMicrosoft Office Publisher Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows Graphic Component Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Type Confusion Vulnerability
- Intel · Ethernet Diagnostics Driver for WindowsIntel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability
- TerraMaster · TerraMaster OSTerraMaster OS Remote Command Execution Vulnerability
- Fortra · GoAnywhere MFTFortra GoAnywhere MFT Remote Code Execution Vulnerability
- Oracle · E-Business SuiteOracle E-Business Suite Unspecified Vulnerability
- SugarCRM · Multiple ProductsMultiple SugarCRM Products Remote Code Execution Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.