Week 42, 2023
16 October to 22 October 2023. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 672CVEs publishedin the whole week
- 84CriticalCVSS 9.0 and above
- 200HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-4966
Unauthenticated sensitive information disclosure
Citrix · NetScaler ADC
ExploitedCritical9.4 - CVE-2023-20198
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list…
Cisco · Cisco IOS XE Software
ExploitedCritical10.0
Most severe new CVEsBy CVSS score
- CVE-2023-20198
Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list…
Cisco · Cisco IOS XE Software
ExploitedCritical10.0 - CVE-2023-3991
OS command injection vulnerability in FreshTomato 2023.3
FreshTomato · FreshTomato
Critical10.0 - CVE-2023-45144
Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App
xwikisas · identity-oauth
Critical10.0 - CVE-2022-42150
TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape.
Product not named
Critical10.0 - CVE-2023-45128
CSRF Token Reuse Vulnerability in fiber
gofiber · fiber
Critical10.0 - CVE-2023-34207
Unrestricted Upload of File with Dangerous Type in EasyUse MailHunter Ultimate
EasyUse Digital Technology · MailHunter Ultimate
Critical9.9 - CVE-2023-34051
VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system…
VMware Aria Operations for Logs
Critical9.8 - CVE-2023-46042
An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().
Product not named
Critical9.8 - CVE-2023-5642
Advantech R-SeeNet Unauthenticated Read/Write
Advantech · R-SeeNet
Critical9.8 - CVE-2023-44693
D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.
Product not named
Critical9.8