CISA Known Exploited Vulnerabilities December, 2023 Update

by Artie Kaye

Your monthly update of high severity flaws which are actively being exploited. If you are using any of the programs or devices listed below it is advised to take the recommended steps to address the problem. Wyo Support News may have reported on some of these vulnerabilities in the past. Below are the items added through the month of November, 2023.

Company	CVE	Platform	Details
Apache	CVE-2023-46604	ActiveMQ	https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt
Atlassian	CVE-2023-22518	Confluence Data Center and Server	https://confluence.atlassian.com/security/cve-2023-22518-improper-authorization-vulnerability-in-confluence-data-center-and-server-1311473907.html
GNU	CVE-2023-4911	C Library	https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1056e5b4c3f2d90ed2b4a55f96add28da2f4c8fa
Google	CVE-2023-6345	Skia	https://chromereleases.googleblog.com/2023/11/stable-channel-update-for-desktop_28.html
IETF	CVE-2023-29552	Service Location Protocol	https://www.cisa.gov/news-events/alerts/2023/04/25/abuse-service-location-protocol-may-lead-dos-attacks https://www.bitsight.com/blog/new-high-severity-vulnerability-cve-2023-29552-discovered-service-location-protocol-slp
Juniper	CVE-2023-36851 CVE-2023-36847 CVE-2023-36846 CVE-2023-36845 CVE-2023-36844	Junos OS	https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US
Microsoft	CVE-2023-36584	Windows	https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36584
	CVE-2023-36036	Windows	https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036
	CVE-2023-36025	Windows	https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36036
	CVE-2023-36033	Windows	https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36033
Oracle	CVE-2020-2551	Fusion Middleware	https://www.oracle.com/security-alerts/cpujan2020.html
ownCloud	CVE-2023-49103	GraphApi	https://owncloud.com/security-advisories/disclosure-of-sensitive-credentials-and-configuration-in-containerized-deployments/
Sophos	CVE-2023-1671	Web Appliance	https://www.sophos.com/en-us/security-advisories/sophos-sa-20230404-swa-rce
SysAid	CVE-2023-47246	SysAid Server	https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification

For a more comprehensive list of all vulnerabilities, visit cisa.gov (Opens in a new tab/window.)

---