Week 15, 2023
10 April to 16 April 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 674CVEs publishedin the whole week
- 83CriticalCVSS 9.0 and above
- 255HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-29492
Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide…
Product not named
ExploitedCritical9.8 - CVE-2023-20963
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User…
Android
ExploitedHigh7.8 - CVE-2023-28252
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-28205
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS…
Apple · iOS and iPadOS
ExploitedHigh8.8 - CVE-2023-28206
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS…
Apple · iOS and iPadOS
ExploitedHigh8.6
Most severe new CVEsBy CVSS score
- CVE-2023-29509
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29214
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29212
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29211
org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29210
org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29209
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability
xwiki · xwiki-platform
Critical10.0 - CVE-2023-27497
Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
SAP · Diagnostics Agent (EventLogServiceCollector)
Critical10.0 - CVE-2023-29205
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro
xwiki · xwiki-platform
Critical10.0 - CVE-2022-41976
An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a…
Product not named
Critical9.9 - CVE-2023-29511
xwiki-platform-administration-ui vulnerable to privilege escalation
xwiki · xwiki-platform
Critical9.9