Week 40, 2023
2 October to 8 October 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 475CVEs publishedin the whole week
- 61CriticalCVSS 9.0 and above
- 137HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-22515
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2023-40044
WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability
Progress Software Corporation · WS_FTP Server
ExploitedCritical10.0 - CVE-2023-42824
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.1 and iPadOS 16.7.1. A local attacker may be able to elevate their privileges.…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2023-42793
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2023-28229
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.0 - CVE-2023-4211
Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations
Arm Ltd · Midgard GPU Kernel Driver
ExploitedMedium5.5 - CVE-2023-5217
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap…
Google · Chrome
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2023-22515
Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknown vulnerability in…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2022-47893
NetMan 204 Remote Code Execution
Riello UPS · Netman-204
Critical10.0 - CVE-2023-41094
Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNet
Silicon Labs · Ember ZNet
Critical10.0 - CVE-2023-2306
Qognify NiceVision Use of Hard-coded Credentials
Qognify · NiceVision
Critical10.0 - CVE-2022-36276
SQL injection vulnerability in TCMAN GIM
TCMAN · GIM
Critical9.9 - CVE-2023-3701
Relative path traversal in Aqua eSolutions
Aqua eSolutions · Aqua Drive
Critical9.9 - CVE-2023-3744
Server-Side Request Forgery in SLiMS
SLiMS · SLiMS
Critical9.9 - CVE-2023-4037
SQL injection in Setelsa Security ConacWin
Setelsa Security · ConacWin
Critical9.9 - CVE-2023-5399
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tampering of files on the…
Schneider Electric · C-Bus Toolkit
Critical9.8 - CVE-2023-44974
An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via uploading a…
Product not named
Critical9.8