Week 21, 2023
22 May to 28 May 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 492CVEs publishedin the whole week
- 63CriticalCVSS 9.0 and above
- 148HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-2868
Remote Code injection in Barracuda Email Security Gateway
Barracuda · Barracuda Email Security Gateway
ExploitedCritical9.4 - CVE-2023-32373
A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS…
Apple · macOS
ExploitedHigh8.8 - CVE-2023-32409
The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8, Safari…
Apple · macOS
ExploitedHigh8.6 - CVE-2023-28204
An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and iPadOS…
Apple · macOS
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2023-2825
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read…
GitLab · GitLab
Critical10.0 - CVE-2023-1424
Denial-of-Service and Remote Code Execution Vulnerability in MELSEC Series CPU module
Mitsubishi Electric Corporation · MELSEC iQ-F Series FX5U-32MT/ES
Critical10.0 - CVE-2023-33246
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
Apache Software Foundation · Apache RocketMQ
ExploitedCritical9.8 - CVE-2023-33010
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware…
Zyxel · ATP series firmware
ExploitedCritical9.8 - CVE-2023-33009
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions…
Zyxel · ATP series firmware
ExploitedCritical9.8 - CVE-2023-2732
MStore API <= 3.9.2 - Authentication Bypass
inspireui · MStore API – Create Native Android & iOS Apps On The Cloud
Critical9.8 - CVE-2023-29919
SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. Any file on the server can be read or modified because texteditor.php is not restricted.
Product not named
Critical9.8 - CVE-2023-30145
Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter.
Product not named
Critical9.8 - CVE-2023-31689
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the…
Product not named
Critical9.8 - CVE-2023-33362
Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.
Product not named
Critical9.8