Mandiant analyzed 138 vulnerabilities that were disclosed in 2023 and that we tracked as exploited in the wild. Consistent with past analyses, the majority (97) of these vulnerabilities were exploited as zero-days (vulnerabilities exploited before patches are made available, excluding end-of-life technologies).
Forty-one vulnerabilities were exploited as n-days (vulnerabilities first exploited after patches are available). While we have previously seen and continue to expect a growing use of zero-days over time, 2023 saw an even larger discrepancy grow between zero-day and n-day exploitation as zero-day exploitation outpaced n-day exploitation more heavily than we have previously observed.
Read more…
Source: Mandiant
Related:
- MacOS security flaw grants admin access to anyone
November 28, 2017
Apple, Apple, Apple. What are we going to do with you? In your most recent High Sierra macOS release, it turns out you’ve given a way for any local user to take over a Mac — lock, stock, and two smoking barrels. This exploit doesn’t require any mad NSA-type hacker skillz. All you have to do is go ...
- HP patches severe code execution bug in enterprise printers
November 23, 2017
HP has issued firmware patches to fix a security flaw which allowed attackers to perform remote code execution attacks on enterprise-grade printers. FoxGlove Security researchers issued an advisory disclosing the technical details of the bug, CVE-2017-2750, earlier this week. The team tested out HP’s PageWide Enterprise Color MFP 586 and the HP Color LaserJet Enterprise M553 models, and found they ...
- Oracle Issues Emergency Patches for ‘JoltandBleed’ Vulnerabilities
November 16, 2017
Oracle pushed out an emergency update for vulnerabilities affecting several of its products that rely on its proprietary Jolt protocol. The bugs were discovered by researchers at ERPScan who named the series of five vulnerabilities JoltandBleed. The vulnerabilities are severe, with two of the bugs scoring 9.9 and 10 on the CVSS scale. Products affected include Oracle PeopleSoft ...
- Bluetooth Hack Affects 20 Million Amazon Echo and Google Home Devices
November 15, 2017
Remember BlueBorne? A series of recently disclosed critical Bluetooth flaws that affect billions of Android, iOS, Windows and Linux devices have now been discovered in millions of AI-based voice-activated personal assistants, including Google Home and Amazon Echo. As estimated during the discovery of this devastating threat, several IoT and smart devices whose operating systems are often updated less frequently than smartphones and ...
- 17-Year-Old MS Office Flaw Lets Hackers Install Malware Without User Interaction
November 14, 2017
You should be extra careful when opening files in MS Office. When the world is still dealing with the threat of ‘unpatched’ Microsoft Office’s built-in DDE feature, researchers have uncovered a serious issue with another Office component that could allow attackers to remotely install malware on targeted computers. The vulnerability is a memory-corruption issue that resides in all ...
- Apple iPhone X’s Face ID Hacked (Unlocked) Using 3D-Printed Mask
November 13, 2017
Just a week after Apple released its brand new iPhone X on November 3, a team of hackers has claimed to successfully hack Apple’s Face ID facial recognition technology with a mask that costs less than $150. Yes, Apple’s “ultra-secure” Face ID security for the iPhone X is not as secure as the company claimed during ...