Week 20, 2023
15 May to 21 May 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 445CVEs publishedin the whole week
- 43CriticalCVSS 9.0 and above
- 154HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2016-6415
The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX…
Product not named
ExploitedHigh7.5 - CVE-2004-1464
Cisco IOS 12.2(15) and earlier allows remote attackers to cause a denial of service (refused VTY (virtual terminal) connections), via a crafted TCP connection…
Product not named
ExploitedMedium5.9 - CVE-2023-21492
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium4.4
Most severe new CVEsBy CVSS score
- CVE-2023-2024
Improper Authentication for OpenBlue Enterprise Manager Data Collector
Johnson Controls · OpenBlue Enterprise Manager Data Collector
Critical10.0 - CVE-2023-1698
WAGO: WBM Command Injection in multiple products
WAGO · Compact Controller CC100
Critical9.8 - CVE-2023-31902
RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote Code Execution (RCE).
Product not named
Critical9.8 - CVE-2023-31986
A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in…
Product not named
Critical9.8 - CVE-2023-32314
Sandbox Escape
patriksimek · vm2
Critical9.8 - CVE-2023-2780
Path Traversal: '\..\filename' in mlflow/mlflow
mlflow · mlflow/mlflow
Critical9.8 - CVE-2023-0600
WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi
Unknown · WP Visitor Statistics (Real Time Traffic)
Critical9.8 - CVE-2023-31856
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute…
Product not named
Critical9.8 - CVE-2022-47937
Multiple parsing problems in the Apache Sling Commons JSON module
Apache Software Foundation · org.apache.sling.commons.json
Critical9.8 - CVE-2023-31903
GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
Product not named
Critical9.8