Week 29, 2023
17 July to 23 July 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 484CVEs publishedin the whole week
- 59CriticalCVSS 9.0 and above
- 118HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-38205
ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
Adobe · ColdFusion
ExploitedHigh7.5 - CVE-2023-29298
Adobe ColdFusion Improper Access Control Security feature bypass
Adobe · ColdFusion
ExploitedHigh7.5 - CVE-2023-3519
Unauthenticated remote code execution
Citrix · NetScaler ADC
ExploitedCritical9.8 - CVE-2023-36884
Windows Search Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2023-3765
Absolute Path Traversal in mlflow/mlflow
mlflow · mlflow/mlflow
Critical10.0 - CVE-2023-3696
Prototype Pollution in automattic/mongoose
automattic · automattic/mongoose
Critical10.0 - CVE-2023-35189
Iagona ScrutisWeb Unrestricted Upload of File with Dangerous Type
iagona · ScrutisWeb
Critical10.0 - CVE-2023-3519
Unauthenticated remote code execution
Citrix · NetScaler ADC
ExploitedCritical9.8 - CVE-2023-38203
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
Adobe · ColdFusion
ExploitedCritical9.8 - CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's…
Product not named
Critical9.8 - CVE-2023-38408
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is…
Product not named
Critical9.8 - CVE-2023-37791
D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.
Product not named
Critical9.8 - CVE-2023-37265
Incorrect identification of source IP addresses in CasaOS
IceWhaleTech · CasaOS-Gateway
Critical9.8 - CVE-2023-37266
Weak json web token (JWT) secrets in CasaOS
IceWhaleTech · CasaOS
Critical9.8