Week 44, 2023
30 October to 5 November 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 647CVEs publishedin the whole week
- 73CriticalCVSS 9.0 and above
- 213HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-46604
Apache ActiveMQ, Apache ActiveMQ Legacy OpenWire Module: Unbounded deserialization causes ActiveMQ to be vulnerable to a remote code execution (RCE) attack
Apache Software Foundation · Apache ActiveMQ
ExploitedCritical10.0 - CVE-2023-46747
BIG-IP Configuration utility unauthenticated remote code execution vulnerability
F5 · BIG-IP
ExploitedCritical9.8 - CVE-2023-46748
BIG-IP Configuration utility authenticated SQL injection vulnerability
F5 · BIG-IP
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2023-22518
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2023-42802
GLPI vulnerable to unallowed PHP script execution
glpi-project · glpi
Critical10.0 - CVE-2023-25960
WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to SQL Injection
Zendrop · Zendrop – Global Dropshipping
Critical10.0 - CVE-2023-20048
A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute…
Cisco · Cisco Firepower Management Center
Critical9.9 - CVE-2023-46404
PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
Product not named
Critical9.9 - CVE-2023-5199
PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
bloafer · PHP to Page
Critical9.9 - CVE-2023-40050
Automate Vulnerable to Malicious Content Uploaded Through Embedded Compliance Application
Progress Software Corporation · Chef Automate
Critical9.9 - CVE-2023-36529
WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL Injection
Favethemes · Houzez - Real Estate WordPress Theme
Critical9.9 - CVE-2023-5360
Royal Elementor Addons and Templates < 1.3.79 - Unauthenticated Arbitrary File Upload
Unknown · Royal Elementor Addons and Templates
Critical9.8 - CVE-2023-23368
QTS, QuTS hero, QuTScloud
QNAP Systems Inc. · QTS
Critical9.8