Week 37, 2023
11 September to 17 September 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 502CVEs publishedin the whole week
- 70CriticalCVSS 9.0 and above
- 188HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-26369
[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Adobe · Acrobat Reader
ExploitedHigh7.8 - CVE-2023-4863
Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-35674
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation…
Google · Android
ExploitedHigh8.8 - CVE-2023-20269
A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could…
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedMedium5.0 - CVE-2023-36802
Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8 - CVE-2023-36761
Microsoft Word Information Disclosure Vulnerability
Microsoft · Microsoft Office 2019
ExploitedMedium6.5 - CVE-2023-41064
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura…
Apple · macOS
ExploitedHigh7.8 - CVE-2023-41061
A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may…
Apple · iOS and iPadOS
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2023-41892
Craft CMS Remote Code Execution vulnerability
craftcms · cms
Critical10.0 - CVE-2023-3710
Printer web page invalid command execution
Honeywell · PM23/43
Critical9.9 - CVE-2023-4994
Allow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
hit-reach · Allow PHP in Posts and Pages
Critical9.9 - CVE-2023-40622
Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)
SAP_SE · SAP BusinessObjects Business Intelligence Platform (Promotion Management)
Critical9.9 - CVE-2023-38204
Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8
Adobe · ColdFusion
Critical9.8 - CVE-2023-41887
Remote Code exec in project import with mysql jdbc url attack
OpenRefine · OpenRefine
Critical9.8 - CVE-2023-2071
FactoryTalk View Machine Edition Vulnerable to Remote Code Execution
Rockwell Automation · Fa
Critical9.8 - CVE-2023-31067
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under…
Product not named
Critical9.8 - CVE-2023-31068
An issue was discovered in TSplus Remote Access through 16.0.2.14. There are Full Control permissions for Everyone on some directories under…
Product not named
Critical9.8 - CVE-2023-39638
D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
Product not named
Critical9.8