Latest Vulnerabilities Updates: AppSecWorld's CVE Daily Digest for October 23-24, 2023

In the dynamic realm of cybersecurity, staying updated on the latest vulnerabilities is imperative.
This edition of the AppSecWorld's CVE Daily Digest provides a snapshot of the vulnerabilities published in National Vulnerability Database between October 23-24, 2023.
During this period, The National Vulnerability Database published 58, and these new Common Vulnerabilities and Exposures (CVEs) are classified as follows:

Critical: 0
High: 8
Medium: 22
Low: 4
Severity Not Assigned: 24

Identifying and understanding these vulnerabilities are pivotal steps towards enhancing security measures and creating a safer digital environment.
Now, let's delve deeper into AppSecWorld's CVE Daily Digest, spotlighting the Critical and High Severity vulnerabilities that demand immediate attention.

1. CVE-2023-5246
Base Score: 8.8
Base Severity: HIGH
Exploitability Score: 2.8
Impact Score: 5.9
Description: Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1051432, 1127487, 1069070, 1112296, 1044072, 1121596, 1099830 allows an unauthenticated remote attacker to potentially impact the availabilty, integrity and confidentaility of the gateways via an authentication bypass by capture-replay.
References: https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.json
https://sick.com/.well-known/csaf/white/2023/sca-2023-0011.pdf
https://sick.com/psirt

CWE-ID: Not assigned as of now
Common Platform Enumerations (CPE): Not Found

2. CVE-2021-26738
Base Score: 7.8
Base Severity: HIGH
Exploitability Score: 1.8
Impact Score: 5.9
Description: Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.



References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=macOS&applicable_version=3.7&deployment_date=2022-08-19&id=1414851

CWE-ID: CWE-426
Common Platform Enumerations (CPE): Not Found

3. CVE-2023-28793
Base Score: 7.8
Base Severity: HIGH
Exploitability Score: 1.8
Impact Score: 5.9
Description: Buffer overflow vulnerability in the signelf library used by Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.



References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19

CWE-ID: CWE-787
Common Platform Enumerations (CPE): Not Found

4. CVE-2023-28795
Base Score: 7.8
Base Severity: HIGH
Exploitability Score: 1.8
Impact Score: 5.9
Description: Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Inclusion of Code in Existing Process. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.




References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19

CWE-ID: CWE-346
Common Platform Enumerations (CPE): Not Found

5. CVE-2023-28796
Base Score: 7.1
Base Severity: HIGH
Exploitability Score: 1.8
Impact Score: 5.2
Description:
Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows Code Injection. This issue affects Zscaler Client Connector for Linux: before 1.3.1.6.




References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2022?applicable_category=Linux&applicable_version=1.3.1&deployment_date=2022-09-19

CWE-ID: CWE-347
Common Platform Enumerations (CPE): Not Found

6. CVE-2023-28804
Base Score: 8.2
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 4.2
Description: An Improper Verification of Cryptographic Signature vulnerability in Zscaler Client Connector on Linux allows replacing binaries.This issue affects Linux Client Connector: before 1.4.0.105
References: https://help.zscaler.com/client-connector/client-connector-app-release-summary-2023

CWE-ID: CWE-347
Common Platform Enumerations (CPE): Not Found

7. CVE-2023-33839
Base Score: 7.2
Base Severity: HIGH
Exploitability Score: 1.2
Impact Score: 5.9
Description: IBM Security Verify Governance 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 256036.
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/256036
https://www.ibm.com/support/pages/node/7057377

CWE-ID: CWE-78
Common Platform Enumerations (CPE): Not Found

8. CVE-2023-5633
Base Score: 7.8
Base Severity: HIGH
Exploitability Score: 1.8
Impact Score: 5.9
Description: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration enabled, a local, unprivileged user could potentially use this flaw to escalate their privileges.
References: https://access.redhat.com/security/cve/CVE-2023-5633
https://bugzilla.redhat.com/show_bug.cgi?id=2245663

CWE-ID: Not assigned as of now
Common Platform Enumerations (CPE): Not Found