---
title: "Security digest: November 30, 2023"
url: https://erroneo.us/security/2023-11-30/
description: "November 30, 2023 vulnerability digest: 2 CISA KEV additions (Google, ownCloud); 3 critical advisories (Maven, Composer (PHP)). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2023-11-30
date_modified: 2023-11-30
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: November 30, 2023

2 known exploited (cisa kev) additions and 3 critical advisories.

## Take stock

- Do you run any of these? Google Chromium Skia, ownCloud ownCloud graphapi. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2023-12-21.
- Maven: 2 critical advisories ( org.apache.cocoon:cocoon ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- Composer (PHP): 1 critical advisory ( elijaa/phpmemcacheadmin ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2023-6345](https://erroneo.us/security/cve/CVE-2023-6345/index.md) Google Chromium Skia: Google Skia Integer Overflow Vulnerability (CISA due 2023-12-21)
- [CVE-2023-49103](https://erroneo.us/security/cve/CVE-2023-49103/index.md) ownCloud ownCloud graphapi: ownCloud graphapi Information Disclosure Vulnerability (CISA due 2023-12-21)

## Critical advisories

- [CVE-2022-45135](https://erroneo.us/security/cve/CVE-2022-45135/index.md) Apache Cocoon SQL Injection vulnerability — Maven org.apache.cocoon:cocoon >= 2.2.0, < 2.3.0 → 2.3.0
- [CVE-2023-6026](https://erroneo.us/security/cve/CVE-2023-6026/index.md) PHPMemcachedAdmin Path Traversal vulnerability — Composer (PHP) elijaa/phpmemcacheadmin <= 1.3.0 → no fix
- [CVE-2023-49733](https://erroneo.us/security/cve/CVE-2023-49733/index.md) Apache Cocoon Improper Restriction of XML External Entity Reference vulnerability — Maven org.apache.cocoon:cocoon >= 2.2.0, < 2.3.0 → 2.3.0

---
Source page: https://erroneo.us/security/2023-11-30/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt