Zero-day report: April 2023
CISA added 17 exploited vulnerabilities to its catalog in April 2023, 1 fewer than March (18). 8 were zero-days, listed within a week of going public. 6 are known to be used by ransomware. The most-hit vendor was Apple, with 3.
By technology
Most-hit vendors
Every flaw added in April 2023
- Google · Chromium SkiaGoogle Chrome Skia Integer Overflow Vulnerability
- PaperCut · MF/NGPaperCut MF/NG Improper Access Control Vulnerability
- MinIO · MinIOMinIO Information Disclosure Vulnerability
- Cisco · IOS and IOS XE SoftwareCisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability
- Apple · macOSApple macOS Use-After-Free Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Android · FrameworkAndroid Framework Privilege Escalation Vulnerability
- Novi Survey · Novi SurveyNovi Survey Insecure Deserialization Vulnerability
- Microsoft · WindowsMicrosoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Use-After-Free Vulnerability
- Apple · iOS, iPadOS, and macOSApple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability
- Microsoft · WindowsMicrosoft Windows Certificate Dialog Privilege Escalation Vulnerability
- Veritas · Backup Exec AgentVeritas Backup Exec Agent File Access Vulnerability
- Veritas · Backup Exec AgentVeritas Backup Exec Agent Improper Authentication Vulnerability
- Veritas · Backup Exec AgentVeritas Backup Exec Agent Command Execution Vulnerability
- Arm · Mali Graphics Processing Unit (GPU)Arm Mali GPU Kernel Driver Information Disclosure Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.