Week 48, 2023

27 November – 3 December 2023

New CVEs: 506
Critical: 47
High: 102
Newly exploited: 2
Advisories: 197
Malicious pkgs: 36

Newly exploited 2

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2023-49103 KEV Nov 30, 2023 An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php librar…
EPSS 78%
Critical 9.6
CVE-2023-6345 KEV Nov 30, 2023 Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a s…
Google · Chrome

EPSS 16%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2023-48022 Ray has arbitrary code execution via jobs submission API
EPSS 84%
Critical 9.8
CVE-2023-3368 Chamilo LMS Unauthenticated Command Injection
chamilo · Chamilo

EPSS 70%
Critical 9.8
CVE-2023-6329 Control iD iDSecure passwordCustom Authentication Bypass
Control iD · iDSecure

EPSS 65%
Critical 9.8
CVE-2023-4473 A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could al…
Zyxel · NAS326 firmware · NAS542 firmware

EPSS 41%
Critical 9.8
CVE-2023-35138 A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versi…
Zyxel · NAS326 firmware · NAS542 firmware

EPSS 40%
Critical 9.1
CVE-2023-48023 Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation,…
EPSS 35%
Critical 9.8
CVE-2023-4474 The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG…
Zyxel · NAS326 firmware · NAS542 firmware

EPSS 30%
Critical 9.8
CVE-2023-47207 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
Delta Electronics · InfraSuite Device Master

EPSS 17%
Critical 9.6
CVE-2023-6345 Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a s…
Google · Chrome

EPSS 16%
Critical 9.8
CVE-2023-41998 Arcserve UDP Unauthenticated RCE
Arcserve · Arcserve UDP

EPSS 15%
Critical 9.8
CVE-2023-48842 D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.
EPSS 3.7%
Critical 9.8
CVE-2023-49371 RuoYi vulnerable to SQL injection vulnerability
EPSS 3.7%
Critical 9.8
CVE-2023-3533 Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write
chamilo · Chamilo

EPSS 3.5%
Critical 9.8
CVE-2023-3545 Chamilo LMS Htaccess File Upload Security Bypass
chamilo · Chamilo

EPSS 2.4%
Critical 9.8
CVE-2023-5604 Asgaros Forum < 2.7.1 - Unauthenticated Arbitrary File Upload
EPSS 2%

All 47 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

USN-6520-1 linux-starfive-6.2 vulnerabilities 16 CVEs
openSUSE-SU-2023:0387-1 Security update for chromium 6 CVEs
DSA-5569-1 chromium - security update 6 CVEs
ICSA-23-331-01 Delta Electronics InfraSuite Device Master 4 CVEs
ICSA-23-334-03 PTC KEPServerEx 2 CVEs
DLA-3675-1 zbar - security update 2 CVEs
RLSA-2023:7213 Critical: squid:4 security update 2 CVEs
USN-6525-1 pysha3 vulnerability 1 CVEs
USN-6524-1 pypy3 vulnerability 1 CVEs
FSA-202305 Festo: Vulnerable WIBU-SYSTEMS CodeMeter Runtime in several products 1 CVEs