Week 23, 2023
5 June to 11 June 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 575CVEs publishedin the whole week
- 59CriticalCVSS 9.0 and above
- 191HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-3079
Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-33010
A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware…
Zyxel · ATP series firmware
ExploitedCritical9.8 - CVE-2023-33009
A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions…
Zyxel · ATP series firmware
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-22583
SQL Injection in Danfoss AK-EM100
Danfoss · AK-EM100
Critical10.0 - CVE-2023-25911
Authenticated OS Command Injection in Danfoss AK-EM100
Danfoss · AK-EM100
Critical9.9 - CVE-2021-4368
Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload
nmedia · Frontend File Manager Plugin
Critical9.9 - CVE-2021-4360
Controlled Admin Access < 1.5.6 - Privilege Escalation
waseem_senjer · Controlled Admin Access
Critical9.9 - CVE-2021-4347
Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Change
zorem · Advanced Shipment Tracking for WooCommerce
Critical9.9 - CVE-2023-20887
Aria Operations for Networks contains a command injection vulnerability. A malicious actor with network access to VMware Aria Operations for Networks may be…
Aria Operations for Networks (Formerly vRealize Network Insight)
ExploitedCritical9.8 - CVE-2020-36708
Epsilon Framework Themes (Various Versions) - Function Injection
machothemes · Antreas
Critical9.8 - CVE-2023-2986
Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass
tychesoftwares · Abandoned Cart Lite for WooCommerce
Critical9.8 - CVE-2023-33532
There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. If an attacker gains web management privileges, they can…
Product not named
Critical9.8 - CVE-2020-36705
Adning Advertising <= 1.5.5 - Arbitrary File Upload
tunafish · Adning Advertising
Critical9.8