Week 33, 2023
14 August to 20 August 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 485CVEs publishedin the whole week
- 69CriticalCVSS 9.0 and above
- 186HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-24489
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to…
Citrix · Citrix ShareFile Storage Zones Controller
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-35082
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the…
Ivanti · EPMM
ExploitedCritical10.0 - CVE-2023-37914
Privilege escalation (PR)/RCE from account through Invitation subject/message
xwiki · xwiki-platform
Critical9.9 - CVE-2023-35893
IBM Security Guardium command execution
IBM · Security Guardium
Critical9.9 - CVE-2023-40020
Improper Authentication in PrivateUploader
PrivateUploader · PrivateUploader
Critical9.9 - CVE-2023-36845
Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable
Juniper Networks · Junos OS
ExploitedCritical9.8 - CVE-2023-26469
In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
Product not named
Critical9.8 - CVE-2023-2917
Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability
Rockwell Automation · ThinManager ThinServer
Critical9.8 - CVE-2022-24989
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object…
Product not named
Critical9.8 - CVE-2023-29468
The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can…
Product not named
Critical9.8 - CVE-2023-39115
install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.
Product not named
Critical9.8