Week 8, 2023
20 February to 26 February 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 342CVEs publishedin the whole week
- 57CriticalCVSS 9.0 and above
- 91HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-47986
IBM Aspera Faspex code execution
IBM · Aspera Faspex
ExploitedCritical9.8 - CVE-2022-41223
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via…
Product not named
ExploitedMedium6.8 - CVE-2022-40765
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network…
Product not named
ExploitedMedium6.8
Most severe new CVEsBy CVSS score
- CVE-2023-25813
SQL Injection via replacements in sequelize
sequelize · sequelize
Critical10.0 - CVE-2022-2024
OS Command Injection in gogs/gogs
gogs · gogs/gogs
Critical9.8 - CVE-2023-25157
Unfiltered SQL Injection Vulnerabilities in Geoserver
geoserver · geoserver
Critical9.8 - CVE-2023-26602
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for…
Product not named
Critical9.8 - CVE-2023-0755
The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary…
PTC · ThingWorx Edge C-SDK
Critical9.8 - CVE-2023-26326
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker…
BuddyForms WordPress Plugin
Critical9.8 - CVE-2023-0232
ShopLentor < 2.5.4 - PHP Object Injection
Unknown · ShopLentor
Critical9.8 - CVE-2022-36231
pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.
Product not named
Critical9.8 - CVE-2023-0754
The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary…
PTC · ThingWorx Edge C-SDK
Critical9.8 - CVE-2023-25696
Apache Airflow Hive Provider Beeline RCE
Apache Software Foundation · Apache Airflow Hive Provider
Critical9.8