Week 51, 2023
18 December to 24 December 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 563CVEs publishedin the whole week
- 119CriticalCVSS 9.0 and above
- 162HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-49897
An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. If this…
FXC Inc. · AE1021PE
ExploitedHigh8.8 - CVE-2023-47565
Legacy VioStor NVR
QNAP Systems Inc. · VioStor NVR
ExploitedHigh8.0
Most severe new CVEsBy CVSS score
- CVE-2023-6977
Path Traversal: '\..\filename'
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-29384
WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload
HM Plugin · WordPress Job Board and Recruitment Plugin – JobWP
Critical10.0 - CVE-2023-25970
WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload
Zendrop · Zendrop – Global Dropshipping
Critical10.0 - CVE-2023-49778
WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to PHP Object Injection
Hakan Demiray · Sayfa Sayac
Critical10.0 - CVE-2023-49773
WordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object Injection
Tim Brattberg · BCorp Shortcodes
Critical10.0 - CVE-2023-49772
WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object Injection
Phpbits Creative Studio · Genesis Simple Love
Critical10.0 - CVE-2023-34007
WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File Upload
WPChill · Download Monitor
Critical9.9 - CVE-2023-33318
WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File Upload
WooCommerce · AutomateWoo
Critical9.9 - CVE-2023-31215
WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File Upload
AmaderCode Lab · Dropshipping & Affiliation with Amazon
Critical9.9 - CVE-2023-34385
WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File Upload
Akshay Menariya · Export Import Menus
Critical9.9