Week 2, 2023
9 January to 15 January 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 662CVEs publishedin the whole week
- 46CriticalCVSS 9.0 and above
- 331HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-21674
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.8 - CVE-2022-41080
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2023-22601
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-330: Use…
InHand Networks · InRouter 302
Critical10.0 - CVE-2023-0018
Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console)
SAP · BusinessObjects Business Intelligence Platform (Central management console)
Critical10.0 - CVE-2023-22600
InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerability CWE-284:…
InHand Networks · InRouter 302
Critical10.0 - CVE-2022-45092
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management…
Siemens · SINEC INS
Critical9.9 - CVE-2023-0022
Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
SAP · BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
Critical9.9 - CVE-2023-0016
SQL Injection vulnerability in SAP Business Planning and Consolidation MS
SAP · SAP BPC MS 10.0
Critical9.9 - CVE-2023-0297
Code Injection in pyload/pyload
pyload · pyload/pyload
Critical9.8 - CVE-2022-3792
SQL Injection in GullsEye Terminal Operating System
GullsEye · GullsEye terminal operating system
Critical9.8 - CVE-2022-46502
Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
Product not named
Critical9.8 - CVE-2022-4873
Stack based overflow on Netcomm router models NF20MESH, NF20, and NL1902
Netcomm · NF20
Critical9.8