Week 7, 2023
13 February to 19 February 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 706CVEs publishedin the whole week
- 67CriticalCVSS 9.0 and above
- 294HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-46169
Unauthenticated Command Injection
Cacti · cacti
ExploitedCritical9.8 - CVE-2023-23529
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura…
Apple · iOS and iPadOS
ExploitedHigh8.8 - CVE-2023-21823
Windows Graphics Component Remote Code Execution Vulnerability
Microsoft · Microsoft Office for Android
ExploitedHigh7.8 - CVE-2023-23376
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2023-21715
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedHigh7.3
Most severe new CVEsBy CVSS score
- CVE-2023-22578
Sequalize - Default support for “raw attributes” when using parentheses
Feathers-Sequalize · Sequelize.js
Critical10.0 - CVE-2023-24482
A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions <…
Siemens · COMOS V10.2
Critical10.0 - CVE-2023-25765
In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able…
Jenkins Project · Jenkins Email Extension Plugin
Critical9.9 - CVE-2023-22579
Sequalize - Unsafe fall-through in getWhereConditions
Feathers-Sequalize · Sequelize.js
Critical9.9 - CVE-2022-47986
IBM Aspera Faspex code execution
IBM · Aspera Faspex
ExploitedCritical9.8 - CVE-2023-25717
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a…
Product not named
ExploitedCritical9.8 - CVE-2022-39952
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through…
Fortinet · FortiNAC
Critical9.8 - CVE-2022-40022
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
Product not named
Critical9.8 - CVE-2023-21716
Microsoft Word Remote Code Execution Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
Critical9.8 - CVE-2022-48323
Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker…
Product not named
Critical9.8