Week 3, 2023
16 January to 22 January 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 485CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 150HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-44877
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell…
Product not named
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-22731
Improper Control of Generation of Code in Twig rendered views in shopware
shopware · platform
Critical10.0 - CVE-2022-45444
CVE-2022-45444
Sewio · RTLS Studio
Critical10.0 - CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
Product not named
ExploitedCritical9.8 - CVE-2023-23488
The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the…
Paid Memberships Pro WordPress Plugin
Critical9.8 - CVE-2022-23521
gitattributes parsing integer overflow in git
git · git
Critical9.8 - CVE-2022-41903
Integer overflow in `git archive`, `git log --format` leading to RCE in git
git · git
Critical9.8 - CVE-2022-4060
User Post Gallery <= 2.19 - Unauthenticated RCE
Unknown · User Post Gallery
Critical9.8 - CVE-2022-46476
D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.
Product not named
Critical9.8 - CVE-2022-46887
Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in…
Product not named
Critical9.8 - CVE-2020-35326
SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value.
Product not named
Critical9.8