Week 46, 2023
13 November to 19 November 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 722CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 271HighCVSS 7.0 to 8.9
- 12Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-1671
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.
Sophos · Sophos Web Appliance
ExploitedCritical9.8 - CVE-2020-2551
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected are…
Oracle Corporation · WebLogic Server
ExploitedCritical9.8 - CVE-2023-36584
Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedMedium5.4 - CVE-2023-36025
Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.8 - CVE-2023-36033
Windows DWM Core Library Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-36036
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-47246
In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited…
Product not named
ExploitedCritical9.8 - CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
Juniper Networks · Junos OS
ExploitedCritical9.8 - CVE-2023-36851
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
Juniper Networks · Junos OS
ExploitedMedium5.3 - CVE-2023-36846
Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
Juniper Networks · Junos OS
ExploitedMedium5.3 - CVE-2023-36844
Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables
Juniper Networks · Junos OS
ExploitedMedium5.3 - CVE-2023-36847
Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files
Juniper Networks · Junos OS
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2023-6018
MLflow Arbitrary File Write
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-6016
H2O Remote Code Execution via POJO Model Import
h2oai · h2oai/h2o-3
Critical10.0 - CVE-2023-6015
MLflow Arbitrary File Upload
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-31273
Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalation of privilege via…
Intel DCM software
Critical10.0 - CVE-2023-43177
CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
Product not named
Critical9.8 - CVE-2023-44353
ColdFusion WDDX Deserialization Gadgets
Adobe · ColdFusion
Critical9.8 - CVE-2023-6019
Ray Command Injection in cpu_profile Parameter
ray-project · ray-project/ray
Critical9.8 - CVE-2023-44350
ColdFusion | Deserialization of Untrusted Data (CWE-502)
Adobe · ColdFusion
Critical9.8 - CVE-2023-45878
GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint…
Product not named
Critical9.8 - CVE-2023-44351
Adobe ColdFusion RCE Security Vulnerability
Adobe · ColdFusion
Critical9.8