Week 4, 2023
23 January to 29 January 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 551CVEs publishedin the whole week
- 57CriticalCVSS 9.0 and above
- 242HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2017-11357
Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perform…
Product not named
ExploitedCritical9.8 - CVE-2022-47966
Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka…
Product not named
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-24022
Hard Coded Credential Crypt Vulnerability
Baicells · Nova 227
Critical10.0 - CVE-2023-23619
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
asyncapi · modelina
Critical10.0 - CVE-2022-45808
WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection
ThimPress · LearnPress – WordPress LMS Plugin
Critical9.9 - CVE-2022-31706
The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an…
vRealize Log Insight (vRLI)
Critical9.8 - CVE-2022-31704
The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an…
vRealize Log Insight (vRLI)
Critical9.8 - CVE-2022-4305
Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
Unknown · Login as User or Customer
Critical9.8 - CVE-2023-23560
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
Product not named
Critical9.8 - CVE-2022-40222
An OS command injection vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted…
Siretta · QUARTZ-GOLD
Critical9.8 - CVE-2022-42493
Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can…
Siretta · QUARTZ-GOLD
Critical9.8 - CVE-2022-42490
Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can…
Siretta · QUARTZ-GOLD
Critical9.8