Week 43, 2023
23 October to 29 October 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 603CVEs publishedin the whole week
- 81CriticalCVSS 9.0 and above
- 258HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-5631
Stored XSS vulnerability in Roundcube
Roundcube · Roundcubemail
ExploitedMedium6.1 - CVE-2023-20273
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the privileges of root.…
Cisco · Cisco IOS XE Software
ExploitedHigh7.2
Most severe new CVEsBy CVSS score
- CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Apache Software Foundation · Apache ActiveMQ
ExploitedCritical10.0 - CVE-2023-37909
Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet
xwiki · xwiki-platform
Critical10.0 - CVE-2023-37912
XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro
xwiki · xwiki-rendering
Critical10.0 - CVE-2023-37913
org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter
xwiki · xwiki-platform
Critical10.0 - CVE-2023-41721
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with…
Ubiquiti · UniFi Network Application
Critical10.0 - CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
VMware · VMware vCenter Server
ExploitedCritical9.8 - CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
F5 · BIG-IP
ExploitedCritical9.8 - CVE-2023-43208
NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the…
Product not named
ExploitedCritical9.8 - CVE-2023-46574
An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile…
Product not named
Critical9.8 - CVE-2023-46347
In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. The…
Product not named
Critical9.8