November 2023
2,560 CVEs published, −7% on October 2023 and +20% on November 2022. CISA added 18 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 30012% of the 2,481 with a CVSS score
- Added to CISA KEV
- 1810 of this month's CVEs are in KEV, listed a median 3.5 days after publication
- Vendors
- 1,5686,986 products
- Top weakness
- XSSCWE-79 · 418 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Gpac134191new
- 2Ооо «ред Софт»Ред Ос13071new
- 3IntelUnison Software, Aptio V Uefi Firmware Integrator Tools, Intel Iris XE Graphics1001nonenew
- 4Ао "нппкт"Осон Основа Оnyx8863new
- 5MicrosoftWindows Server 2022, Windows 11 22h2, Windows 11 21h28335new
- 6AdobeAcrobat Reader Dc, Adobe Acrobat 2020, Adobe Acrobat Reader 2020774nonenew
- 7GoogleAndroid, Chrome, Google Chrome7561new
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»7541new
- 9PackagistMoodle/moodle, Symfony/symfony, Librenms/librenms674nonenew
- 10Red HatRed Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7662nonenew
- 11MavenOrg.opencrx:opencrx-core-models, Com.xuxueli:xxl-job-admin, Org.jenkins-ci.plugins:matlab6514nonenew
- 12FedoraprojectFedora, Extra Packages For Enterprise Linux6233new
- 13PyPIApache-superset, Aiohttp, Ray5410nonenew
- 14Ао «ивк»Альт Сп 10, Альт 8 Сп542nonenew
- 15UnknownSeraphinite Accelerator, Wp Hotel Booking, Awesome Support528nonenew
- 16CiscoFirepower Threat Defense, Cisco Firepower Threat Defense Software, Cisco Firepower Management Center391nonenew
- 17GoGithub.com/mattermost/mattermost/server/v8, Github.com/mattermost/mattermost-server/v6, Github.com/projectcapsule/capsule-proxy373nonenew
- 18DebianDebian Linux3623new
- 19Unisoc (Shanghai) Technologies Co., Ltd.Sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618/t760/t770/t820/s8000, T760/t770/t820/s8000, Sc7731e/sc9832e/sc9863a/t310/t606/t612/t616/t610/t618340nonenew
- 20SamsungAndroid, Account, Exynos 1380 Firmware330nonenew
- 21Samsung MobileSamsung Mobile Devices, Samsung Account, Samsung Push Service300nonenew
- 22Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Rosa Virtualization301nonenew
- 23Projectworlds Pvt. LimitedOnline Food Ordering System, Online Matrimonial Project, Online Examination System2926nonenew
- 24Apache Software FoundationApache Superset, Apache Dolphinscheduler, Airflow286nonenew
- 25ApacheSuperset, Dolphinscheduler, Cocoon266nonenew
Severity
How this month's CVEs score on CVSS; 79 have no score yet. Severity is not exploitation.
- Critical300
- High783
- Medium1,286
- Low112
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS418
- CWE-352CSRF250
- CWE-89SQL Injection173
- CWE-787Out-of-bounds Write130
- CWE-200Information Exposure93
- CWE-125Out-of-bounds Read75
- CWE-20Improper Input Validation72
- CWE-22Path Traversal65
- CWE-284Improper Access Control62
- CWE-416Use After Free57
- CWE-862Missing Authorization56
- CWE-120Buffer Overflow54
- CWE-78OS Command Injection46
- CWE-434Unrestricted File Upload42
- CWE-287Improper Authentication39
- CWE-94Code Injection37
- CWE-269Improper Privilege Mgmt36
- CWE-918SSRF35
- CWE-400Resource Consumption33
- CWE-123626
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins80523% of sector-tagged CVEs
- Operating Systems39812% of sector-tagged CVEs
- OSS Libraries37711% of sector-tagged CVEs
- Enterprise Software33410% of sector-tagged CVEs
- Hardware Firmware3129% of sector-tagged CVEs
- Networking Infrastructure2076% of sector-tagged CVEs
- ICS / OT / IoT1484% of sector-tagged CVEs
- Mobile Apps1384% of sector-tagged CVEs
- Consumer Software1344% of sector-tagged CVEs
- Cloud & SaaS1314% of sector-tagged CVEs
- Not yet classified184
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 352CSRF | 89SQL Injection | 787Out-of-bounds Write | 200Information Exposure | 125Out-of-bounds Read | 20Improper Input Validation | 22Path Traversal | 284Improper Access Control | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 7 | 4 | 2 | 9 | 2 | 4 | 2 | 3 | 1 | 24 |
| Ооо «ред Софт» | 9 | 1 | 10 | 1 | 4 | 2 | 2 | 2 | 24 | |
| Intel | 1 | 3 | 3 | 3 | 12 | 5 | 16 | 1 | ||
| Ао «нппкт» | 3 | 1 | 6 | 6 | 2 | 21 | ||||
| Microsoft Corp | 5 | 2 | 1 | 2 | 5 | 1 | 10 | |||
| Adobe | 1 | 2 | 10 | 34 | 4 | 1 | 1 | 8 | ||
| Adobe Systems Inc. | 1 | 2 | 10 | 33 | 4 | 1 | 8 | |||
| Ооо «русбитех-астра» | 2 | 4 | 3 | 1 | 22 | |||||
| 1 | 11 | 1 | 3 | 11 | ||||||
| Microsoft | 5 | 2 | 1 | 2 | 5 | 1 | 3 | |||
| Packagist | 18 | 1 | 1 | 6 | 1 | 2 | 8 | |||
| Maven | 13 | 5 | 1 | 4 | 4 | 5 |
CVEs published in November 2023
15 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php library that provides a URL. When this URL i...KEV10.0
- CVE-2023-47246In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited in the wild in November 2023.KEV9.8
- CVE-2023-49105An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has ...KEV9.8
- CVE-2023-48365Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to ele...KEV9.6
- CVE-2023-6345Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a malicious file. (C...KEV9.6
- CVE-2023-36025Windows SmartScreen Security Feature Bypass VulnerabilityKEV8.8
- CVE-2023-42917A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may lead to ar...KEV8.8
- CVE-2023-36033Windows DWM Core Library Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-36036Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-36424Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-42916An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 17.1.2 and iPadOS 17.1.2, macOS Sonoma 14.1.2, Safari 17.1.2. Processing web content may disclose sens...KEV6.5
- CVE-2023-6125Code Injection in salesagility/suitecrm8.8
- CVE-2023-47690WordPress Additional Order Filters for WooCommerce Plugin <= 1.10 is vulnerable to Cross Site Scripting (XSS)7.1
- CVE-2023-47865Username and Icon override can be used by members when Hardened Mode is enabled4.3
- CVE-2023-47060ZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure Vulnerability3.3