Week 28, 2023
10 July to 16 July 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 840CVEs publishedin the whole week
- 97CriticalCVSS 9.0 and above
- 267HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2022-29303
SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.
Product not named
ExploitedCritical9.8 - CVE-2023-37450
The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6.…
Apple · Safari
ExploitedHigh8.8 - CVE-2022-31199
Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents…
Product not named
ExploitedCritical9.8 - CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedHigh8.8 - CVE-2023-32049
Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.8 - CVE-2023-36874
Windows Error Reporting Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-32046
Windows MSHTML Platform Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2023-37462
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui
xwiki · xwiki-platform
Critical10.0 - CVE-2023-3342
User Registration <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Upload
wpeverest · User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Critical9.9 - CVE-2023-29130
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of improper access controls in the configuration files…
Siemens · SIMATIC CN 4100
Critical9.9 - CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe · ColdFusion
ExploitedCritical9.8 - CVE-2023-24489
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to…
Citrix · Citrix ShareFile Storage Zones Controller
ExploitedCritical9.8 - CVE-2023-37582
Apache RocketMQ: Possible remote code execution when using the update configuration function
Apache Software Foundation · Apache RocketMQ
Critical9.8 - CVE-2023-34124
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS:…
SonicWall · GMS
Critical9.8 - CVE-2023-37629
Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to "add-pig.php."
Product not named
Critical9.8 - CVE-2023-34132
Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks. This issue affects GMS:…
SonicWall · GMS
Critical9.8 - CVE-2023-3595
Rockwell Automation ControlLogix Communication Modules Vulnerable to Remote Code Execution
Rockwell Automation · 1756-EN2T Series A, B, C
Critical9.8