Week 36, 2023
4 September to 10 September 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 580CVEs publishedin the whole week
- 47CriticalCVSS 9.0 and above
- 218HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-33246
Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
Apache Software Foundation · Apache RocketMQ
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2023-20238
A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform…
Cisco · Cisco BroadWorks
Critical10.0 - CVE-2023-39967
Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
wiremock · wiremock
Critical10.0 - CVE-2023-40029
Cluster secret might leak in cluster details page in Argo CD
argoproj · argo-cd
Critical9.9 - CVE-2023-39424
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dll
Resort Data Processing, Inc. · IRM Next Generation
Critical9.9 - CVE-2023-39420
Use of Hard-coded Credentials in RDPCore.dll
Resort Data Processing, Inc. · IRM Next Generation
Critical9.9 - CVE-2023-39361
Unauthenticated SQL Injection in graph_view.php in Cacti
Cacti · cacti
Critical9.8 - CVE-2023-4634
Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
dglingren · Media Library Assistant
Critical9.8 - CVE-2023-37759
Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to register as an Admin…
Product not named
Critical9.8 - CVE-2023-40743
Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
Apache Software Foundation · Apache Axis
Critical9.8 - CVE-2023-4613
Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
LG Electronics · LG-LED Assistant
Critical9.8