Week 38, 2023
18 September to 24 September 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 342CVEs publishedin the whole week
- 61CriticalCVSS 9.0 and above
- 148HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-41179
A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security and Worry-Free…
Trend Micro, Inc. · Trend Micro Apex One
ExploitedHigh7.2 - CVE-2023-28434
MinIO is vulnerable to privilege escalation on Linux/MacOS
minio · minio
ExploitedHigh8.8 - CVE-2021-3129
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of…
Product not named
ExploitedCritical9.8 - CVE-2014-8361
The miniigd SOAP service in Realtek SDK allows remote attackers to execute arbitrary code via a crafted NewInternalClient request, as exploited in the wild…
Product not named
ExploitedCritical9.8 - CVE-2017-6884
A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic…
Product not named
ExploitedHigh8.8 - CVE-2022-22265
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
Samsung Mobile · Samsung Mobile Devices
ExploitedMedium5.0
Most severe new CVEsBy CVSS score
- CVE-2023-2163
Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation
Linux · Linux Kernel
Critical10.0 - CVE-2023-42454
SQLpage vulnerable to public exposure of database credentials
lovasoa · SQLpage
Critical10.0 - CVE-2023-41084
Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking
Socomec · MODULYS GP (MOD3GP-SY-120K)
Critical10.0 - CVE-2023-42793
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2023-5074
Authentication Bypass in D-Link D-View 8
D-Link · D-View 8
Critical9.8 - CVE-2023-31719
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
Product not named
Critical9.8 - CVE-2023-33831
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST…
Product not named
Critical9.8 - CVE-2023-43240
D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
Product not named
Critical9.8 - CVE-2019-19450
paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element…
Product not named
Critical9.8 - CVE-2023-43373
Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php.
Product not named
Critical9.8