Week 11, 2023
13 March to 19 March 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 516CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 199HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-26360
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe · ColdFusion
ExploitedHigh8.6 - CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft · Microsoft Office LTSC 2021
ExploitedCritical9.8 - CVE-2022-41328
A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 through 7.2.3, 7.0.0…
Fortinet · FortiOS
ExploitedMedium6.5 - CVE-2023-24880
Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedMedium4.4
Most severe new CVEsBy CVSS score
- CVE-2022-43605
An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c.…
EIP Stack Group · OpENer
Critical10.0 - CVE-2022-43604
An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c.…
EIP Stack Group · OpENer
Critical10.0 - CVE-2023-28100
TIOCLINUX can send commands outside sandbox if running on a virtual console
flatpak · flatpak
Critical10.0 - CVE-2023-25616
Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)
SAP · Business Objects Business Intelligence Platform (CMC)
Critical9.9 - CVE-2022-38074
WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection
VeronaLabs · WP Statistics
Critical9.9 - CVE-2023-23857
Improper Access Control in SAP NetWeaver AS for Java
SAP · NetWeaver AS for Java
Critical9.9 - CVE-2023-25280
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr…
Product not named
ExploitedCritical9.8 - CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft · Microsoft Office LTSC 2021
ExploitedCritical9.8 - CVE-2023-28461
Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using…
Product not named
ExploitedCritical9.8 - CVE-2023-28343
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter,…
Product not named
Critical9.8