Week 45, 2023
6 November to 12 November 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 563CVEs publishedin the whole week
- 61CriticalCVSS 9.0 and above
- 141HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-29552
The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use…
Product not named
ExploitedHigh7.5 - CVE-2023-22518
All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an…
Atlassian · Confluence Data Center
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2023-46731
Remote code execution through the section parameter in Administration as guest in XWiki Platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-46243
Code execution via the edit action in XWiki platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-4699
Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products
Mitsubishi Electric Corporation · MELSEC-F Series FX3U-16MT/ES
Critical10.0 - CVE-2023-4804
Quantum HD Unity
Johnson Controls · Quantum HD Unity Compressor
Critical10.0 - CVE-2023-38547
A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration…
Veeam · One
Critical9.9 - CVE-2021-43609
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in…
Product not named
Critical9.9 - CVE-2023-6069
Improper Link Resolution Before File Access in froxlor/froxlor
froxlor · froxlor/froxlor
Critical9.9 - CVE-2023-45163
1E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution
1E · Platform
Critical9.9 - CVE-2023-5964
1E-Exchange-DisplayMessage instruction allows for arbitrary code execution
1E · Platform
Critical9.9 - CVE-2023-45161
1E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution
1E · Platform
Critical9.9