Zero-day report: December 2023
CISA added 11 exploited vulnerabilities to its catalog in December 2023, 7 fewer than November (18). 6 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Qualcomm, with 4.
By technology
Most-hit vendors
Every flaw added in December 2023
- QNAP · VioStor NVRQNAP VioStor NVR OS Command Injection Vulnerability
- FXC · AE1021, AE1021PEFXC AE1021, AE1021PE OS Command Injection Vulnerability
- Unitronics · Vision PLC and HMIUnitronics Vision PLC and HMI Insecure Default Password Vulnerability
- Qlik · SenseQlik Sense HTTP Tunneling Vulnerability
- Qlik · SenseQlik Sense Path Traversal Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Use-After-Free Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Use-After-Free Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Vulnerability
- Qualcomm · Multiple ChipsetsQualcomm Multiple Chipsets Integer Overflow Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Out-of-Bounds Read Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Memory Corruption Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.