Week 34, 2023
21 August to 27 August 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 473CVEs publishedin the whole week
- 56CriticalCVSS 9.0 and above
- 168HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-32315
Openfire administration console authentication bypass
igniterealtime · Openfire
ExploitedHigh8.6 - CVE-2023-38831
RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because…
Product not named
ExploitedHigh7.8 - CVE-2023-38035
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication…
Ivanti · MobileIron Sentry
ExploitedCritical9.8 - CVE-2023-27532
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to…
Veeam Backup & Replication
ExploitedHigh7.5 - CVE-2023-26359
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe · ColdFusion
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2022-36648
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host…
Product not named
Critical10.0 - CVE-2023-40177
XWiki Platform privilege escalation (PR) from account through AWM content fields
xwiki · xwiki-platform
Critical9.9 - CVE-2023-25915
Authenticated Remote Command Execution in Danfoss AK-SM800A
Danfoss · AK-SM800A
Critical9.9 - CVE-2023-38035
A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication…
Ivanti · MobileIron Sentry
ExploitedCritical9.8 - CVE-2023-39750
D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. This vulnerability is exploited via a crafted…
Product not named
Critical9.8 - CVE-2023-39751
TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm.
Product not named
Critical9.8 - CVE-2023-39747
TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at…
Product not named
Critical9.8 - CVE-2022-48565
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to…
Product not named
Critical9.8 - CVE-2022-48522
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
Product not named
Critical9.8 - CVE-2023-36281
An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a…
Product not named
Critical9.8