Week 24, 2023
12 June to 18 June 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 580CVEs publishedin the whole week
- 78CriticalCVSS 9.0 and above
- 243HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-27997
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below, version 6.0.16 and…
Fortinet · FortiOS-6K7K
ExploitedCritical9.2
Most severe new CVEsBy CVSS score
- CVE-2023-34251
Grav Server Side Template Injection vulnerability
getgrav · grav
Critical10.0 - CVE-2023-25910
A vulnerability has been identified in SIMATIC PCS 7 (All versions < V9.1 SP2 UC04), SIMATIC S7-PM (All versions < V5.7 SP1 HF1), SIMATIC S7-PM (All versions <…
Siemens · SIMATIC PCS 7
Critical10.0 - CVE-2022-36331
Impersonation attack causing an Authentication Bypass on Western Digital devices
Western Digital · My Cloud OS 5
Critical10.0 - CVE-2023-34157
Vulnerability of HwWatchHealth being hijacked.Successful exploitation of this vulnerability may cause repeated pop-up windows of the app.
Huawei · HarmonyOS
Critical10.0 - CVE-2022-43684
ACL bypass in Reporting functionality
ServiceNow · Now Platform
Critical9.9 - CVE-2023-29357
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Server 2019
ExploitedCritical9.8 - CVE-2023-35708
In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection…
Product not named
Critical9.8 - CVE-2023-35813
Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3.
Product not named
Critical9.8 - CVE-2023-35042
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a…
Product not named
Critical9.8 - CVE-2023-33625
D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the…
Product not named
Critical9.8