Week 6, 2023
6 February to 12 February 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 555CVEs publishedin the whole week
- 48CriticalCVSS 9.0 and above
- 167HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-24990
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to…
Product not named
ExploitedCritical9.8 - CVE-2015-2291
(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of…
Product not named
ExploitedHigh7.8 - CVE-2023-0669
Fortra GoAnywhere MFT License Response Servlet Command Injection
Fortra · Goanywhere MFT
ExploitedHigh7.2
Most severe new CVEsBy CVSS score
- CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
dompdf · dompdf
Critical10.0 - CVE-2022-43757
Rancher: Exposure of sensitive fields
SUSE · Rancher
Critical9.9 - CVE-2022-24990
TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to…
Product not named
ExploitedCritical9.8 - CVE-2023-23333
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through…
Product not named
Critical9.8 - CVE-2022-45699
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as…
Product not named
Critical9.8 - CVE-2022-3229
Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker…
Unified Intents AB · Unified Remote
Critical9.8 - CVE-2022-47071
In NVS365 V01, the background network test function can trigger command execution.
Product not named
Critical9.8 - CVE-2023-0744
Improper Access Control in answerdev/answer
answerdev · answerdev/answer
Critical9.8 - CVE-2023-23163
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.
Product not named
Critical9.8 - CVE-2023-23162
Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.
Product not named
Critical9.8