Week 5, 2023
30 January to 5 February 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 455CVEs publishedin the whole week
- 89CriticalCVSS 9.0 and above
- 167HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-21587
Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected…
Oracle Corporation · Web Applications Desktop Integrator
ExploitedCritical9.8 - CVE-2023-22952
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
Product not named
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2023-23924
URI validation failure on SVG parsing in Dompdf
dompdf · dompdf
Critical10.0 - CVE-2022-22486
IBM Tivoli Workload Scheduler XML external entity injection
IBM · Tivoli Workload Scheduler
Critical10.0 - CVE-2023-0671
Code Injection in froxlor/froxlor
froxlor · froxlor/froxlor
Critical9.9 - CVE-2023-23076
OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
Product not named
Critical9.8 - CVE-2023-25135
vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This…
Product not named
Critical9.8 - CVE-2022-4395
Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload
Unknown · Membership For WooCommerce
Critical9.8 - CVE-2022-47002
A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
Product not named
Critical9.8 - CVE-2022-47003
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
Product not named
Critical9.8 - CVE-2022-45297
EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
Product not named
Critical9.8 - CVE-2022-27596
Vulnerability in QTS
QNAP Systems Inc. · QuTS hero
Critical9.8