Week 19, 2023
8 May to 14 May 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 846CVEs publishedin the whole week
- 79CriticalCVSS 9.0 and above
- 273HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-25717
Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a…
Product not named
ExploitedCritical9.8 - CVE-2016-8735
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if…
Apache Software Foundation · Apache Tomcat
ExploitedCritical9.8 - CVE-2016-3427
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect…
Product not named
ExploitedCritical9.8 - CVE-2021-3560
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.…
polkit
ExploitedHigh7.8 - CVE-2010-3904
The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not…
Product not named
ExploitedHigh7.8 - CVE-2015-5317
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a…
Product not named
ExploitedHigh7.5 - CVE-2014-0196
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case,…
Product not named
ExploitedMedium5.5 - CVE-2023-29336
Win32k Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2023-2583
Code Injection in jsreport/jsreport
jsreport · jsreport/jsreport
Critical10.0 - CVE-2023-32069
XWiki Platform privilege escalation (PR)/RCE from account through class sheet
xwiki · xwiki-platform
Critical10.0 - CVE-2023-27407
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user…
Siemens · SCALANCE LPE9403
Critical9.9 - CVE-2023-30899
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3…
Siemens · Siveillance Video 2020 R2
Critical9.9 - CVE-2023-30898
A vulnerability has been identified in Siveillance Video 2020 R2 (All versions < V20.2 HotfixRev14), Siveillance Video 2020 R3 (All versions < V20.3…
Siemens · Siveillance Video 2020 R2
Critical9.9 - CVE-2023-24941
Windows Network File System Remote Code Execution Vulnerability
Microsoft · Windows Server 2019
Critical9.8 - CVE-2023-32243
WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation
WPDeveloper · Essential Addons for Elementor
Critical9.8 - CVE-2023-27823
An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.
Product not named
Critical9.8 - CVE-2023-1650
ChatBot < 4.4.7 - Unauthenticated PHP Object Injection
Unknown · AI ChatBot
Critical9.8 - CVE-2023-30194
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
Product not named
Critical9.8