Vulnerability report: December 2023
Vulnerability report December 2023: the CVEs with the highest CVSSv3 scores (8 to 10), the products affected and the CERT-FR advisories you need to know.
Why this selection?
We have selected the highest CVSSv3 scores (8 & 10).
Our aim:
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores**.**
- To tell you the type of vulnerability**.**
- To provide the CVE identifier and the CERT-FR advisory reference.
- To raise your awareness of the importance of this news.
News bulletin from 27 November to 26 December 2023
| CVSSv3 score | Product | Vendor | CVE ID | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 10 | Schneider Electric | ProLeiT Plant iT/Brewmaxx (Redis) | CVE-2022-0543 | Remote arbitrary code execution | CERTFR-2023-AVI-1014 |
| 9.8 | OpenSSH | OpenSSH | CVE-2023-51385 | Arbitrary code execution | CERTFR-2023-AVI-1044 |
| 9.8 | Siemens | SIMATIC, SIPLUS | CVE-2023-45871 | Remote arbitrary code execution | CERTFR-2023-AVI-1037 |
| 9.8 | Siemens | RUGGEDCOM, SCALANCE | CVE-2023-45853 | Arbitrary code execution | CERTFR-2023-AVI-1015 |
| 9.6 | Microsoft | Microsoft Power Platform Connector | CVE-2023-36019 | Security policy bypass | CERTFR-2023-AVI-1025 |
| 9.6 | Chrome | CVE-2023-6345 | Remote arbitrary code execution | CERTFR-2023-AVI-0985 | |
| 9.6 | Microsoft | Edge | CVE-2023-35618 | Privilege escalation | CERTFR-2023-AVI-1006 |
| 9.1 | Siemens | SCALANCE | CVE-2023-44373 | Remote arbitrary code execution | CERTFR-2023-AVI-1015 |
| 9.0 | Atlassian | Confluence | CVE-2023-22522 | Remote arbitrary code execution | CERTFR-2023-AVI-1001 |
| 9.0 | Fortinet | FortiMail | CVE-2023-47539 | Security policy bypass | CERTFR-2023-AVI-1018 |
| 8.8 | Apple | iOS, iPadOS | CVE-2023-42917 | Remote arbitrary code execution | CERTFR-2023-AVI-1013 |
| 8.8 | Microsoft | Internet Connection Sharing (ICS) | CVE-2023-35641 and 35630 | Remote arbitrary code execution | CERTFR-2023-AVI-1023 |
| 8.1 | Microsoft | Windows MSHTML Platform | CVE-2023-35628 | Remote arbitrary code execution | CERTFR-2023-AVI-1023 |
| Not specified | Apple | iOS, iPadOS, MacOS, Safari | CVE-2023-42917 | Data confidentiality breach | CERTFR-2023-AVI-0987 |
| Not specified | Apple | iOS, iPadOS, MacOS, Safari | CVE-2023-42916 | Remote arbitrary code execution | CERTFR-2023-AVI-0987 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.