A critical vulnerability has been discovered in Apache OFBiz resulting from an incomplete fix to CVE-2023-49070. Discovered by SonicWall, this CVE is classified as CVE-2023-51467 and is being tracked as an Authentication Bypass vulnerability. According to NVD, this vulnerability allows for attackers to bypass authentication to achieve a simple Server-Side Request Forgery. This vulnerability can be considered a zero-day as there is proof-of-concept code available from SonicWall’s investigation.

Microsoft has identified several vulnerabilities in Perforce Helix Core Server, the most critical of which is CVE-2023-45849. With a CVSS score of 9.8, this vulnerability allows arbitrary code execution which results in privilege escalation. This vulnerability manifests if the administrator setting up the server does not run the “p4 protect” command immediately after installing the server. Without this command, an unauthenticated anonymous attacker could run arbitrary command lines (powershell) as LocalSystem when Perforce Server is installed in its default configuration.

An OS command injection vulnerability exists in AE1021PE/AE1021 routers in firmware version 2.0.9 and earlier. The vulnerability is classified as CVE-2023-49897 and has a CVSS score of 8.8 HIGH. If exploited, the vulnerability allows an arbitrary OS command to be executed by an attacker who can login to the product. This vulnerability is currently under active exploitation by the “InfectedSlurs” botnet and has been designated a zero-day vulnerability.

Every second Tuesday of the month, Microsoft releases many security fixes to several of its software solutions. This is known as “Patch Tuesday.” December 2023 was a lighter patch Tuesday than usual, with only a small number of critical vulnerabilities that require patching. Of the 33 vulnerabilities reported, 4 are rated ‘critical’ and 29 ‘important.’

A vulnerability was recently discerned by Marc Newlin, Principal Reverse Engineer for Skysafe. This vulnerability, classified as CVE-2023-45866 allows unauthenticated keystroke-injection through Bluetooth. This is done by tricking the Bluetooth host machine into pairing with a fake keyboard through an unauthenticated pairing mechanism defined in the Bluetooth specification.

Atlassian has released four security advisories and patches fixing remote code execution flaws in several Atlassian products. The CVEs mentioned are CVE-2022-1471, CVE-2023-22523, CVE-2023-22524, and CVE-2023-22522 each having a CVSS 3.1 score ranging from 9.0 – 9.8 according to Atlassian and the National Vulnerability Database.

A Use-After-Free (UAF) vulnerability has been identified in the Linux kernel which is identified as CVE-2023-40283 with a CVSS 3.1 score of 7.8 HIGH. The issue was discovered in l2cap_sock_release in /net/Bluetooth/l2cap_sock.c in versions of the linux kernel before 6.4.10. This is one of several recent vulnerabilities associated with the Linux kernel which all allow for a Secure Boot Bypass. The collection of vulnerabilities dubbed LogoFAIL leverages the UEFI BIOs capabilities of displaying images during boot to achieve arbitrary code execution and compromise the security of the entire system.

Google Chrome versions prior to 119.0.6045.199 are vulnerable to CVE-2023-6345 (CVSS v3: 8.8) a vulnerability with evidence of active exploitation. An integer overflow exists in Skia which allows a remote attacker who had compromised the renderer process to potentially perform a sandbox escape with a malicious file.

A vulnerability was discovered in ownCloud, a tool used to share and sync data collaboratively, classified as CVE-2023-49103. MITRE has designated this vulnerability with a CVSS score of 10.0. It is related to the graphapi portion of the application. Because the graphapi relys on a third-party library to provide a URL that contains the phpinfo, the viewing of sensitive data such as ownCloud admin password, mail server credentials, and license key is allowed.