Week 49, 2023
4 December to 10 December 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 693CVEs publishedin the whole week
- 88CriticalCVSS 9.0 and above
- 281HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-41265
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and…
Product not named
ExploitedCritical9.6 - CVE-2023-41266
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier,…
Product not named
ExploitedHigh8.2 - CVE-2023-33107
Integer Overflow or Wraparound in Graphics Linux
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.4 - CVE-2023-33106
Use of Out-of-range Pointer Offset in Graphics
Qualcomm, Inc. · Snapdragon
ExploitedHigh8.4 - CVE-2022-22071
Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon…
Qualcomm, Inc. · Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
ExploitedHigh8.4 - CVE-2023-33063
Use After Free in DSP Services
Qualcomm, Inc. · Snapdragon
ExploitedHigh7.8 - CVE-2023-42917
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2.…
Apple · Safari
ExploitedHigh8.8 - CVE-2023-42916
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2.…
Apple · Safari
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2023-6269
Argument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCF
Atos Unify · OpenScape Session Border Controller (SBC)
Critical10.0 - CVE-2023-4122
Student Information System v1.0 - Insecure File Upload
Kashipara Group · Student Information System
Critical9.9 - CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8 - CVE-2023-49070
Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present
Apache Software Foundation · Apache OFBiz
Critical9.8 - CVE-2023-50164
Apache Struts: File upload component had a directory traversal vulnerability
Apache Software Foundation · Apache Struts
Critical9.8 - CVE-2023-22523
This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery agent installed.…
Atlassian · Assets Discovery Cloud
Critical9.8 - CVE-2023-49007
In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd.
Product not named
Critical9.8 - CVE-2023-40077
In multiple functions of MetaDataBase.cpp, there is a possible UAF write due to a race condition. This could lead to remote escalation of privilege with no…
Google · Android
Critical9.8 - CVE-2023-48316
Azure RTOS NetX Duo Remote Code Execution Vulnerability
azure-rtos · netxduo
Critical9.8 - CVE-2023-49437
Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList.
Product not named
Critical9.8