Week 26, 2023
26 June to 2 July 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 507CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 146HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2019-17621
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands…
Product not named
ExploitedCritical9.8 - CVE-2019-20500
D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web…
Product not named
ExploitedHigh7.8 - CVE-2021-25487
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary…
Samsung Mobile · Samsung Mobile Devices
ExploitedHigh7.3 - CVE-2021-25395
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.4 - CVE-2021-25394
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is…
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.4 - CVE-2021-25372
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.1 - CVE-2021-25371
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium6.1 - CVE-2021-25489
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to…
Samsung Mobile · Samsung Mobile Devices
ExploitedLow3.3
Most severe new CVEsBy CVSS score
- CVE-2023-36469
Code injection through NotificationRSSService in XWiki Platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-36470
Code injection in icon themes of XWiki Platform
xwiki · xwiki-platform
Critical10.0 - CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
xwiki · xwiki-platform
Critical10.0 - CVE-2023-33190
Improperly configured permissions in Sealos
labring · sealos
Critical10.0 - CVE-2023-22814
Authentication Bypass issue in My Cloud OS 5 devices
Western Digital · My Cloud OS 5
Critical10.0 - CVE-2023-34598
Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in…
Product not named
Critical9.8 - CVE-2023-2982
WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass
cyberlord92 · miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)
Critical9.8 - CVE-2023-2068
File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode
Unknown · file-manager-advanced-shortcode
Critical9.8 - CVE-2023-30261
Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.
Product not named
Critical9.8 - CVE-2023-26613
An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands…
Product not named
Critical9.8