Week 30, 2023
24 July to 30 July 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 398CVEs publishedin the whole week
- 49CriticalCVSS 9.0 and above
- 147HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-37580
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Product not named
ExploitedMedium6.1 - CVE-2023-38606
This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6,…
Apple · tvOS
ExploitedMedium5.5 - CVE-2023-35078
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without…
Ivanti · Endpoint Manager Mobile
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2023-35078
An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without…
Ivanti · Endpoint Manager Mobile
ExploitedCritical10.0 - CVE-2023-26045
NodeBB vulnerable to path traversal and code execution via prototype vulnerability
NodeBB · NodeBB
Critical10.0 - CVE-2023-32231
An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818. During installation, binaries gets executed out of a subfolder in…
Product not named
Critical9.9 - CVE-2023-32232
An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836. During client installation and repair, a PrinterLogic binary is called by…
Product not named
Critical9.9 - CVE-2023-38992
jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.
Product not named
Critical9.8 - CVE-2023-31465
An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. By intercepting requests from various timekeeper streams, it is possible to find the…
Product not named
Critical9.8 - CVE-2023-37754
PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
Product not named
Critical9.8 - CVE-2023-37895
Apache Jackrabbit RMI access can lead to RCE
Apache Software Foundation · Apache Jackrabbit Webapp (jackrabbit-webapp)
Critical9.8 - CVE-2023-33308
A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy version 7.0.0 through…
Fortinet · FortiProxy
Critical9.8 - CVE-2023-34478
Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.
Apache Software Foundation · Apache Shiro
Critical9.8