Week 31, 2023
31 July to 6 August 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 451CVEs publishedin the whole week
- 68CriticalCVSS 9.0 and above
- 152HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-35081
A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to…
Ivanti · EPMM
ExploitedHigh7.2
Most severe new CVEsBy CVSS score
- CVE-2023-39344
social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE
fobybus · social-media-skeleton
Critical10.0 - CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
metabase · metabase
Critical10.0 - CVE-2023-38702
Knowage Server vulnerable to path traversal via upload functionality
KnowageLabs · Knowage-Server
Critical10.0 - CVE-2023-4195
PHP Remote File Inclusion in cockpit-hq/cockpit
cockpit-hq · cockpit-hq/cockpit
Critical9.9 - CVE-2023-4159
Unrestricted Upload of File with Dangerous Type in omeka/omeka-s
omeka · omeka/omeka-s
Critical9.9 - CVE-2023-37679
A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.
Product not named
Critical9.8 - CVE-2023-34960
A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API…
Product not named
Critical9.8 - CVE-2022-39986
A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in…
Product not named
Critical9.8 - CVE-2023-39143
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote…
Product not named
Critical9.8 - CVE-2023-29689
PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability…
Product not named
Critical9.8