Week 13, 2023
27 March to 2 April 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 713CVEs publishedin the whole week
- 71CriticalCVSS 9.0 and above
- 322HighCVSS 7.0 to 8.9
- 9Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-42948
Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely…
Product not named
ExploitedCritical9.8 - CVE-2017-7494
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a…
Samba · samba
ExploitedCritical9.8 - CVE-2022-38181
The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through…
Product not named
ExploitedHigh8.8 - CVE-2022-3038
Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2013-3163
Microsoft Internet Explorer 8 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web…
Product not named
ExploitedHigh8.8 - CVE-2023-0266
Use after free in SNDRV_CTL_IOCTL_ELEM in Linux Kernel
Linux · Linux Kernel
ExploitedHigh7.9 - CVE-2022-22706
Arm Mali GPU Kernel Driver allows a non-privileged user to achieve write access to read-only memory pages. This affects Midgard r26p0 through r31p0, Bifrost…
Product not named
ExploitedHigh7.8 - CVE-2021-30900
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 14.8.1 and iPadOS 14.8.1, iOS 15.1 and iPadOS 15.1. A…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2022-39197
An XSS (Cross Site Scripting) vulnerability was found in HelpSystems Cobalt Strike through 4.7 that allowed a remote attacker to execute HTML on the Cobalt…
Product not named
ExploitedMedium6.1
Most severe new CVEsBy CVSS score
- CVE-2022-47190
RCE via file upload vulnerability in Generex CS141
Generex · UPS CS141
Critical10.0 - CVE-2022-3682
SDM600 file permission validation
Hitachi Energy · SDM600
Critical9.9 - CVE-2022-36974
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
Ivanti · Avalanche
Critical9.8 - CVE-2023-25076
A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit:…
SNIProxy · SNIProxy
Critical9.8 - CVE-2023-28503
Authentication bypass in UniRPC's udadmin service
Rocket Software · UniData
Critical9.8 - CVE-2023-28502
Stack buffer overflow in UniRPC's udadmin_server service
Rocket Software · UniData
Critical9.8 - CVE-2023-1133
CVE-2023-1133
Delta Electronics · InfraSuite Device Master
Critical9.8 - CVE-2022-43634
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this…
Netatalk · Netatalk
Critical9.8 - CVE-2023-27394
CVE-2023-27394
ProPump and Controls, Inc. · Osprey Pump Controller
Critical9.8 - CVE-2022-36971
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. Although authentication is…
Ivanti · Avalanche
Critical9.8