Week 41, 2023
9 October to 15 October 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 642CVEs publishedin the whole week
- 69CriticalCVSS 9.0 and above
- 268HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-21608
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
Adobe · Acrobat Reader
ExploitedHigh7.8 - CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
Product not named
ExploitedHigh7.5 - CVE-2023-20109
A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated,…
Cisco · IOS
ExploitedMedium6.6 - CVE-2023-36563
Microsoft WordPad Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedMedium6.5 - CVE-2023-41763
Skype for Business Elevation of Privilege Vulnerability
Microsoft · Skype for Business Server 2015 CU13
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2023-45138
Change Request Application vulnerable to XSS and remote code execution through change request title
xwiki-contrib · application-changerequest
Critical10.0 - CVE-2023-4309
Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. These vulnerabilities allow an…
Election Services Co. (ESC) · Internet Election Service
Critical10.0 - CVE-2023-5572
Server-Side Request Forgery (SSRF) in vriteio/vrite
vriteio · vriteio/vrite
Critical10.0 - CVE-2023-34976
Video Station
QNAP Systems Inc. · Video Station
Critical10.0 - CVE-2023-45162
Blind SQL vulnerability in 1E platform
1E · 1E Platform
Critical9.9 - CVE-2023-30806
Sangfor Next-Gen Application Firewall PHPSESSID Command Injection
Sangfor · Net-Gen Application Firewall
Critical9.8 - CVE-2023-30805
Sangfor Next-Gen Application Firewall Login Un Param Command Injection
Sangfor · Net-Gen Application Firewall
Critical9.8 - CVE-2023-32645
A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. A specially crafted network request can…
Yifan · YF325
Critical9.8 - CVE-2023-30803
Sangfor Next-Gen Application Firewall Authentication Bypass
Sangfor · Net-Gen Application Firewall
Critical9.8 - CVE-2023-45852
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell…
Product not named
Critical9.8