Week 39, 2023
25 September to 1 October 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 617CVEs publishedin the whole week
- 69CriticalCVSS 9.0 and above
- 193HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker…
[UNKNOWN] · RichFaces
ExploitedCritical9.8 - CVE-2023-41993
The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is…
Apple · macOS
ExploitedHigh8.8 - CVE-2023-41992
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attacker may be…
Apple · macOS
ExploitedHigh7.8 - CVE-2023-41991
A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypass…
Apple · iOS and iPadOS
ExploitedMedium5.5
Most severe new CVEsBy CVSS score
- CVE-2023-40044
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
Progress Software Corporation · WS_FTP Server
ExploitedCritical10.0 - CVE-2023-43654
TorchServe Server-Side Request Forgery
pytorch · serve
Critical10.0 - CVE-2023-40455
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent sandbox…
Apple · macOS
Critical10.0 - CVE-2023-38586
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sonoma 14. A sandboxed process may be able to circumvent…
Apple · macOS
Critical10.0 - CVE-2023-42657
WS_FTP Server Directory Traversal
Progress Software Corporation · WS_FTP Server
Critical9.9 - CVE-2023-5183
Authenticated RCE due to unsafe JSON deserialization
Illumio · Core PCE
Critical9.9 - CVE-2023-5201
OpenHook <= 4.3.0 - Authenticated (Subscriber+) Remote Code Execution via Shortcode
brazenlygeek · OpenHook
Critical9.9 - CVE-2023-43187
A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute…
Product not named
Critical9.8 - CVE-2023-4521
Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE
Unknown · Import XML and RSS Feeds
Critical9.8 - CVE-2023-4490
WP Job Portal < 2.0.6 - Unauthenticated SQLi
Unknown · WP Job Portal
Critical9.8