Week 50, 2023
11 December to 17 December 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 874CVEs publishedin the whole week
- 75CriticalCVSS 9.0 and above
- 259HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-6448
Unitronics VisiLogic uses a default administrative password
Unitronics · VisiLogic
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-50721
XWiki Platform RCE from account through SearchAdmin
xwiki · xwiki-platform
Critical10.0 - CVE-2023-45894
The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a remote attacker to…
Product not named
Critical10.0 - CVE-2023-50723
XWiki Platform remote code execution/programming rights with configuration section from any user account
xwiki · xwiki-platform
Critical10.0 - CVE-2023-6709
Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-6723
Unrestricted Upload of File with Dangerous Type in Repox
Repox · Repox
Critical10.0 - CVE-2023-6553
Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution
inisev · BackupBliss – Backup & Migration with Free Cloud Storage
Critical9.8 - CVE-2023-48085
Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
Product not named
Critical9.8 - CVE-2023-50917
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo…
Product not named
Critical9.8 - CVE-2023-48084
Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
Product not named
Critical9.8 - CVE-2023-46456
In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload functionality.
Product not named
Critical9.8