Week 10, 2023
6 March to 12 March 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 470CVEs publishedin the whole week
- 57CriticalCVSS 9.0 and above
- 129HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2021-39144
XStream is vulnerable to a Remote Command Execution attack
x-stream · xstream
ExploitedHigh8.5 - CVE-2020-5741
Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code.
Plex Media Server (Windows)
ExploitedHigh7.2 - CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection.
Product not named
ExploitedCritical9.8 - CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
Apache Software Foundation · Apache Spark
ExploitedHigh8.8 - CVE-2022-28810
Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the…
Product not named
ExploitedMedium6.8
Most severe new CVEsBy CVSS score
- CVE-2023-27482
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through…
home-assistant · core
Critical10.0 - CVE-2023-26489
Guest-controlled out-of-bounds read/write on x86_64 in wasmtime
bytecodealliance · wasmtime
Critical10.0 - CVE-2023-1283
Code Injection in builderio/qwik
builderio · builderio/qwik
Critical10.0 - CVE-2023-27479
Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui
xwiki · xwiki-platform
Critical10.0 - CVE-2023-25690
Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy
Apache Software Foundation · Apache HTTP Server
Critical9.8 - CVE-2021-36393
In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
Moodle
Critical9.8 - CVE-2023-24734
An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file.
Product not named
Critical9.8 - CVE-2023-24775
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
Product not named
Critical9.8 - CVE-2023-27853
NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary…
NETGEAR Nighthawk WiFi6 Router
Critical9.8 - CVE-2021-36394
In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.
Moodle
Critical9.8