Zero-day report: November 2023
CISA added 18 exploited vulnerabilities to its catalog in November 2023, 0 more than October (18). 7 were zero-days, listed within a week of going public. 3 are known to be used by ransomware. The most-hit vendor was Juniper, with 5.
By technology
Most-hit vendors
Every flaw added in November 2023
- ownCloud · ownCloud graphapiownCloud graphapi Information Disclosure Vulnerability
- Google · Chromium SkiaGoogle Skia Integer Overflow Vulnerability
- GNU · GNU C LibraryGNU C Library Buffer Overflow Vulnerability
- Oracle · Fusion MiddlewareOracle Fusion Middleware Unspecified Vulnerability
- Sophos · Web ApplianceSophos Web Appliance Command Injection Vulnerability
- Microsoft · WindowsMicrosoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows SmartScreen Security Feature Bypass Vulnerability
- Microsoft · WindowsMicrosoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability
- Juniper · Junos OSJuniper Junos OS EX Series PHP External Variable Modification Vulnerability
- Juniper · Junos OSJuniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
- Juniper · Junos OSJuniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
- Juniper · Junos OSJuniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
- Juniper · Junos OSJuniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
- SysAid · SysAid ServerSysAid Server Path Traversal Vulnerability
- IETF · Service Location Protocol (SLP)Service Location Protocol (SLP) Denial-of-Service Vulnerability
- Atlassian · Confluence Data Center and ServerAtlassian Confluence Data Center and Server Improper Authorization Vulnerability
- Apache · ActiveMQApache ActiveMQ Deserialization of Untrusted Data Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.