Week 47, 2023
20 November to 26 November 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 377CVEs publishedin the whole week
- 44CriticalCVSS 9.0 and above
- 113HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-4911
Glibc: buffer overflow in ld.so leading to privilege escalation
glibc
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2023-49103
An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php…
Product not named
ExploitedCritical10.0 - CVE-2023-6248
Data leakage and arbitrary remote code execution in Syrus cloud devices
Digital Communications Technologies · Syrus4 IoT Telematics Gateway
Critical10.0 - CVE-2023-40151
Red Lion Controls Sixnet RTU Exposed Dangerous Method Or Function
Red Lion Controls · ST-IPm-8460
Critical10.0 - CVE-2023-42770
Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or Channel
Red Lion Controls · ST-IPm-8460
Critical10.0 - CVE-2023-35762
OS Command Injection in INEA ME RTU
INEA · ME RTU
Critical9.9 - CVE-2023-49105
An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of…
Product not named
ExploitedCritical9.8 - CVE-2023-5652
WP Hotel Booking < 2.0.8 - Unauthenticated SQLi
Unknown · WP Hotel Booking
Critical9.8 - CVE-2023-37924
Apache Submarine: SQL injection from unauthorized login
Apache Software Foundation · Apache Submarine
Critical9.8 - CVE-2023-2437
UserPro <= 5.1.1 - Authentication Bypass to Administrator
UserPro - Community and User Profile WordPress Plugin
Critical9.8 - CVE-2023-49210
The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts…
Product not named
Critical9.8