Week 16, 2023
17 April to 23 April 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 539CVEs publishedin the whole week
- 55CriticalCVSS 9.0 and above
- 151HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-27350
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not…
PaperCut · NG
ExploitedCritical9.8 - CVE-2023-2136
Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a…
Google · Chrome
ExploitedCritical9.6 - CVE-2023-28432
Minio Information Disclosure in Cluster Deployment
minio · minio
ExploitedHigh7.5 - CVE-2017-6742
A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute…
Cisco · Cisco IOS XE Software
ExploitedHigh8.8 - CVE-2023-2033
Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8 - CVE-2019-8526
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated…
Apple · macOS
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2023-29525
Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29524
Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-22621
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote…
Product not named
Critical10.0 - CVE-2021-33970
Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.
Product not named
Critical10.0 - CVE-2023-29523
Code injection in display method used in user profiles in xwiki-platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29514
Code injection in template provider administration in xwiki-platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-29510
Code injection via unescaped translations in xwiki-platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-2131
CVE-2023-2131
INEA · ME RTU
Critical10.0 - CVE-2021-33975
Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.
Product not named
Critical10.0 - CVE-2021-33972
Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.
Product not named
Critical10.0