Week 9, 2023
27 February to 5 March 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 486CVEs publishedin the whole week
- 55CriticalCVSS 9.0 and above
- 155HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-36537
ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component…
Product not named
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2023-26477
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-26475
XWiki Platform vulnerable to Remote Code Execution in Annotations
xwiki · xwiki-platform
Critical10.0 - CVE-2023-26055
XWiki Commons may allow privilege escalation to programming rights via user's first name
xwiki · xwiki-commons
Critical10.0 - CVE-2023-26472
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
xwiki · xwiki-platform
Critical10.0 - CVE-2023-26471
XWiki Platform users may execute anything with superadmin right through comments and async macro
xwiki · xwiki-platform
Critical10.0 - CVE-2023-26474
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
xwiki · xwiki-platform
Critical10.0 - CVE-2023-27372
SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. The fixed versions are 3.2.18, 4.0.10,…
Product not named
Critical9.8 - CVE-2022-45551
An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network…
Product not named
Critical9.8 - CVE-2023-25234
Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.
Product not named
Critical9.8 - CVE-2023-20078
Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities
Cisco · Cisco IP Phones with Multiplatform Firmware
Critical9.8