Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: June 2023

100 records · 17 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2023-32707
    59Plan

    ‘edit_user’ Capability Privilege Escalation

    HighCVSS 8.8WeaponizedEPSS 79%

    splunk · splunkJun 1, 2023

  • CVE-2023-32714
    45Plan

    Path Traversal in Splunk App for Lookup File Editing

    HighCVSS 8.1No exploitEPSS 42%

    splunk · splunkJun 1, 2023

  • CVE-2022-45938
    50Plan

    An issue was discovered in Comcast Defined Technologies microeisbss through 2021.

    CriticalCVSS 9.0No exploitEPSS 45%

    xfinity · comcast defined technologies microeisbssJun 2, 2023

  • CVE-2023-34362
    99Now

    In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    progress · moveit cloudJun 2, 2023

  • CVE-2023-30149
    44Plan

    SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for P

    CriticalCVSS 9.8No exploitEPSS 16%

    ebewe · city autocompleteJun 2, 2023

  • CVE-2023-3096
    31Monitor

    KylinSoft kylin-software-properties changedSource access control

    HighCVSS 7.8No exploitEPSS 0%

    kylinos · kylin-software-propertiesJun 5, 2023

  • CVE-2023-3079
    76This week

    Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8KEVWeaponizedEPSS 37%

    google · chromeJun 5, 2023

  • CVE-2023-2833
    40Plan

    ReviewX <= 1.6.13 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation

    HighCVSS 8.8Proof of conceptEPSS 17%

    wpdeveloper · reviewxJun 6, 2023

  • CVE-2023-33381
    35Monitor

    A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0

    HighCVSS 7.2Proof of conceptEPSS 22%

    mitrastar · gpt-2741gnac firmwareJun 6, 2023

  • CVE-2023-33532
    44Plan

    There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48.

    CriticalCVSS 9.8No exploitEPSS 16%

    netgear · r6250 firmwareJun 6, 2023

  • CVE-2023-0921
    42Plan

    Allocation of Resources Without Limits or Throttling in GitLab

    MediumCVSS 4.3No exploitEPSS 84%

    gitlab · gitlabJun 6, 2023

  • CVE-2023-2801
    21Monitor

    Grafana is an open-source platform for monitoring and observability.

    MediumCVSS 5.3No exploitEPSS 0%

    grafana · grafanaJun 6, 2023

  • CVE-2023-33781
    44Plan

    An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.

    HighCVSS 8.8Proof of conceptEPSS 31%

    dlink · dir-842v2 firmwareJun 6, 2023

  • CVE-2023-33782
    46Plan

    D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.

    HighCVSS 8.8Proof of conceptEPSS 35%

    dlink · dir-842v2 firmwareJun 6, 2023

  • CVE-2020-36708
    59Plan

    Epsilon Framework Themes (Various Versions) - Function Injection

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    colorlib · activelloJun 6, 2023

  • CVE-2021-4374
    60This week

    WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options Update

    CriticalCVSS 9.8WeaponizedEPSS 16%

    valvepress · wordpress automatic pluginJun 6, 2023

  • CVE-2023-3124
    42Plan

    Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_option

    HighCVSS 8.8Proof of conceptEPSS 22%

    elementor · elementor proJun 6, 2023

  • CVE-2023-33538
    77This week

    TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component

    HighCVSS 8.8KEVWeaponizedEPSS 41%

    tp-link · tl-wr940n firmwareJun 7, 2023

  • CVE-2023-20887
    98Now

    Aria Operations for Networks contains a command injection vulnerability.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    vmware · aria operations for networksJun 7, 2023

  • CVE-2023-20888
    60This week

    Aria Operations for Networks contains an authenticated deserialization vulnerability.

    HighCVSS 8.8Proof of conceptEPSS 82%

    vmware · vrealize network insightJun 7, 2023

  • CVE-2023-20889
    54Plan

    Aria Operations for Networks contains an information disclosure vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 79%

    vmware · vrealize network insightJun 7, 2023

  • CVE-2023-2442
    50Plan

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 befo

    MediumCVSS 5.4No exploitEPSS 96%

    gitlab · gitlabJun 7, 2023

  • CVE-2023-2986
    52Plan

    Abandoned Cart Lite for WooCommerce <= 5.15.1 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    tychesoftwares · abandoned cart lite for woocommerceJun 7, 2023

  • CVE-2023-34096
    54Plan

    Thruk has Path Traversal Vulnerability in panorama.pm

    HighCVSS 8.8Proof of conceptEPSS 62%

    thruk · thrukJun 8, 2023

  • CVE-2023-32749
    39Monitor

    Pydio Cells allows users by default to create so-called external users in order to share files with them.

    HighCVSS 8.8Proof of conceptEPSS 14%

    pydio · cellsJun 8, 2023

  • CVE-2023-0992
    52Plan

    Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1No exploitEPSS 93%

    getshieldsecurity · shield securityJun 9, 2023

  • CVE-2023-2249
    53Plan

    wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents

    HighCVSS 8.8No exploitEPSS 60%

    gvectors · wpforo forumJun 9, 2023

  • CVE-2023-0342
    60This week

    MongoDB Ops Manager may disclose sensitive information in Diagnostic Archive

    MediumCVSS 5.3WeaponizedEPSS 0%

    mongodb · ops manager serverJun 9, 2023

  • CVE-2023-32731
    30Monitor

    Information leak in gRPC

    HighCVSS 7.5No exploitEPSS 0%

    grpc · grpcJun 9, 2023

  • CVE-2023-35036
    40Plan

    In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL in

    CriticalCVSS 9.1No exploitEPSS 12%

    progress · moveit transferJun 11, 2023

  • CVE-2023-35042
    52Plan

    GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:Litera

    CriticalCVSS 9.8No exploitEPSS 44%

    geoserver · geoserverJun 12, 2023

  • CVE-2023-3206
    36Monitor

    Chengdu VEC40G denial of service

    HighCVSS 7.5No exploitEPSS 18%

    feiyuxing · vec40g firmwareJun 12, 2023

  • CVE-2023-34468
    54Plan

    Apache NiFi: Potential Code Injection with Database Services using H2

    HighCVSS 8.8WeaponizedEPSS 61%

    apache · nifiJun 12, 2023

  • CVE-2023-33625
    60This week

    D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter i

    CriticalCVSS 9.8WeaponizedEPSS 33%

    dlink · dir-600 firmwareJun 12, 2023

  • CVE-2023-34941
    28Monitor

    A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execut

    MediumCVSS 5.4No exploitEPSS 23%

    asus · rt-n10lx firmwareJun 12, 2023

  • CVE-2023-27997
    95Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,

    CriticalCVSS 9.8KEVWeaponizedEPSS 85%

    fortinet · fortiproxyJun 13, 2023

  • CVE-2023-33919
    42Plan

    A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05).

    HighCVSS 7.2No exploitEPSS 47%

    siemens · cpci85 firmwareJun 13, 2023

  • CVE-2023-33568
    60This week

    An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer fil

    HighCVSS 7.5WeaponizedEPSS 14%

    dolibarr · dolibarr erp\/crmJun 13, 2023

  • CVE-2023-20867
    49Plan

    VMware Tools Authentication Bypass Vulnerability

    LowCVSS 3.9KEVWeaponizedEPSS 13%

    vmware · toolsJun 13, 2023

  • CVE-2023-3215
    39Monitor

    Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a cra

    HighCVSS 8.8No exploitEPSS 13%

    google · chromeJun 13, 2023

  • CVE-2023-3217
    39Monitor

    Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a craf

    HighCVSS 8.8No exploitEPSS 13%

    google · chromeJun 13, 2023

  • CVE-2023-3224
    57Plan

    Code Injection in nuxt/nuxt

    CriticalCVSS 9.8No exploitEPSS 58%

    nuxt · nuxtJun 13, 2023

  • CVE-2023-29357
    99Now

    Microsoft SharePoint Server Elevation of Privilege Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · sharepoint serverJun 13, 2023

  • CVE-2023-29360
    69This week

    Microsoft Streaming Service Elevation of Privilege Vulnerability

    HighCVSS 8.4KEVWeaponizedEPSS 21%

    microsoft · windows 10 1607Jun 13, 2023

  • CVE-2023-32029
    47Plan

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 53%

    microsoft · 365 appsJun 13, 2023

  • CVE-2023-33133
    44Plan

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 44%

    microsoft · 365 appsJun 13, 2023

  • CVE-2023-3001
    41Plan

    A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious p

    HighCVSS 7.8No exploitEPSS 31%

    schneider-electric · igss dashboardJun 14, 2023

  • CVE-2023-34747
    45Plan

    File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload.

    CriticalCVSS 9.8No exploitEPSS 20%

    ujcms · ujcmsJun 14, 2023

  • CVE-2023-28310
    40Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.0No exploitEPSS 25%

    microsoft · exchange serverJun 14, 2023

  • CVE-2023-32031
    59Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 81%

    microsoft · exchange serverJun 14, 2023

  • CVE-2023-34800
    48Plan

    D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main.

    CriticalCVSS 9.8No exploitEPSS 28%

    dlink · go-rt-ac750 firmwareJun 15, 2023

  • CVE-2023-28810
    20Monitor

    Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities.

    MediumCVSS 4.3Proof of conceptEPSS 10%

    hikvision · ds-k1t804af firmwareJun 15, 2023

  • CVE-2023-35708
    68This week

    In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL

    CriticalCVSS 9.8Proof of conceptEPSS 96%

    progress · moveit transferJun 16, 2023

  • CVE-2023-30625
    61This week

    rudder-server vulnerable to SQL Injection

    HighCVSS 8.8WeaponizedEPSS 85%

    rudderstack · rudder-serverJun 16, 2023

  • CVE-2023-34659
    43Plan

    jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.

    CriticalCVSS 9.8Proof of conceptEPSS 12%

    jeecg · jeecg bootJun 16, 2023

  • CVE-2023-35813
    65This week

    Multiple Sitecore products allow remote code execution.

    CriticalCVSS 9.8Proof of conceptEPSS 86%

    sitecore · experience commerceJun 17, 2023

  • CVE-2023-3306
    46Plan

    Ruijie RG-EW1200G Admin Password app.09df2a9e44ab48766f5f.js access control

    CriticalCVSS 9.8No exploitEPSS 23%

    ruijie · rg-ew1200g firmwareJun 18, 2023

  • CVE-2023-27992
    94Now

    The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21(AAZF.14)C0, NAS540 firmware vers

    CriticalCVSS 9.8KEVWeaponizedEPSS 82%

    zyxel · nas326 firmwareJun 19, 2023

  • CVE-2023-2533
    74This week

    PaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF

    HighCVSS 8.8KEVWeaponizedEPSS 28%

    papercut · papercut mfJun 20, 2023

  • CVE-2023-34600
    46Plan

    Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    adiscon · loganalyzerJun 20, 2023

  • CVE-2023-35166
    54Plan

    Privilege escalation (PR) from account through TipsPanel

    HighCVSS 8.8No exploitEPSS 62%

    xwiki · xwikiJun 20, 2023

  • CVE-2023-35885
    61This week

    CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.

    CriticalCVSS 9.8Proof of conceptEPSS 74%

    mgt-commerce · cloudpanelJun 20, 2023

  • CVE-2023-34563
    43Plan

    netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.

    CriticalCVSS 9.8No exploitEPSS 13%

    netgear · r6250 firmwareJun 20, 2023

  • CVE-2023-33584
    43Plan

    Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL q

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    enrollment system project · enrollment systemJun 21, 2023

  • CVE-2023-24261
    34Monitor

    A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST r

    HighCVSS 7.2No exploitEPSS 18%

    gl-inet · gl-e750 firmwareJun 21, 2023

  • CVE-2023-33405
    33Monitor

    Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect.

    MediumCVSS 6.1Proof of conceptEPSS 31%

    blogengine · blogengine.netJun 21, 2023

  • CVE-2023-29708
    34Monitor

    An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted p

    HighCVSS 7.5No exploitEPSS 14%

    wavlink · wavrouter appJun 22, 2023

  • CVE-2023-20894
    49Plan

    The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.

    CriticalCVSS 9.8No exploitEPSS 33%

    vmware · vcenter serverJun 22, 2023

  • CVE-2023-29711
    60This week

    An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted

    CriticalCVSS 9.8No exploitEPSS 70%

    interlink · psg-5124 firmwareJun 22, 2023

  • CVE-2023-32571
    49Plan

    Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods in

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    dynamic-linq · linqJun 22, 2023

  • CVE-2023-36355
    49Plan

    TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm.

    CriticalCVSS 9.9Proof of conceptEPSS 31%

    tp-link · tl-wr940n firmwareJun 22, 2023

  • CVE-2023-33299
    46Plan

    A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attack

    CriticalCVSS 9.8No exploitEPSS 24%

    fortinet · fortinacJun 23, 2023

  • CVE-2023-30258
    67This week

    Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenti

    CriticalCVSS 9.8WeaponizedEPSS 94%

    magnussolution · magnusbillingJun 23, 2023

  • CVE-2023-35150
    55Plan

    XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application

    HighCVSS 8.0No exploitEPSS 77%

    xwiki · xwikiJun 23, 2023

  • CVE-2023-28204
    60This week

    An out-of-bounds read was addressed with improved input validation.

    MediumCVSS 6.5KEVWeaponizedEPSS 14%

    apple · safariJun 23, 2023

  • CVE-2023-32373
    69This week

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 8.8KEVWeaponizedEPSS 12%

    apple · safariJun 23, 2023

  • CVE-2023-32409
    69This week

    The issue was addressed with improved bounds checks.

    HighCVSS 8.6KEVWeaponizedEPSS 16%

    apple · safariJun 23, 2023

  • CVE-2023-32434
    76This week

    An integer overflow was addressed with improved input validation.

    HighCVSS 7.8KEVWeaponizedEPSS 51%

    apple · ipadosJun 23, 2023

  • CVE-2023-32435
    72This week

    A memory corruption issue was addressed with improved state management.

    HighCVSS 8.8KEVWeaponizedEPSS 22%

    apple · safariJun 23, 2023

  • CVE-2023-32439
    72This week

    A type confusion issue was addressed with improved checks.

    HighCVSS 8.8KEVWeaponizedEPSS 23%

    apple · safariJun 23, 2023

  • CVE-2023-3388
    49Plan

    Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 84%

    beautiful-cookie-banner · beautiful cookie consent bannerJun 23, 2023

  • CVE-2023-36661
    60This week

    Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element.

    HighCVSS 7.5WeaponizedEPSS 2%

    shibboleth · xmltoolingJun 25, 2023

  • CVE-2023-30261
    49Plan

    Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.

    CriticalCVSS 9.8No exploitEPSS 31%

    openwb · openwbJun 26, 2023

  • CVE-2023-33404
    47Plan

    An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earl

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    blogengine · blogengine.netJun 26, 2023

  • CVE-2023-3420
    52Plan

    Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8No exploitEPSS 56%

    google · chromeJun 26, 2023

  • CVE-2023-32521
    56Plan

    A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated r

    CriticalCVSS 9.1No exploitEPSS 66%

    trendmicro · mobile securityJun 26, 2023

  • CVE-2023-2068
    60This week

    File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

    CriticalCVSS 9.8WeaponizedEPSS 39%

    advancedfilemanager · file manager advanced shortcodeJun 27, 2023

  • CVE-2023-2877
    42Plan

    Formidable Forms < 6.3.1 - Subscriber+ Remote Code Execution

    HighCVSS 8.8Proof of conceptEPSS 22%

    strategy11 · formidable formsJun 27, 2023

  • CVE-2023-21237
    52Plan

    In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or

    MediumCVSS 5.5KEVWeaponizedEPSS 0%

    google · androidJun 28, 2023

  • CVE-2023-3450
    43Plan

    Ruijie RG-BCR860 Network Diagnostic Page os command injection

    HighCVSS 7.2Proof of conceptEPSS 50%

    ruijie · rg-bcr860 firmwareJun 28, 2023

  • CVE-2023-2982
    53Plan

    WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    miniorange · wordpress social login and register \(discord\, google\, twitter\, linkedin\)Jun 28, 2023

  • CVE-2023-34598
    53Plan

    Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the inst

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    gibbonedu · gibbonJun 29, 2023

  • CVE-2023-26613
    48Plan

    An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operati

    CriticalCVSS 9.8No exploitEPSS 31%

    dlink · dir-823g firmwareJun 29, 2023

  • CVE-2023-31222
    44Plan

    Medtronic Paceart MSMQ Deserialization of Untrusted Data

    HighCVSS 8.8No exploitEPSS 28%

    medtronic · paceart optimaJun 29, 2023

  • CVE-2023-36469
    60This week

    Code injection through NotificationRSSService in XWiki Platform

    HighCVSS 8.8No exploitEPSS 82%

    xwiki · xwikiJun 29, 2023

  • CVE-2023-36347
    40Plan

    A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data.

    HighCVSS 7.5Proof of conceptEPSS 34%

    codekop · codekopJun 29, 2023

  • CVE-2023-36144
    41Plan

    An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file o

    HighCVSS 7.5Proof of conceptEPSS 36%

    intelbras · sg 2404 mr firmwareJun 30, 2023

  • CVE-2023-36812
    60This week

    Remote Code Execution in OpenTSDB

    CriticalCVSS 9.8WeaponizedEPSS 16%

    opentsdb · opentsdbJun 30, 2023

  • CVE-2023-28324
    60This week

    A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote c

    CriticalCVSS 9.8WeaponizedEPSS 12%

    ivanti · endpoint managerJun 30, 2023

  • CVE-2023-28364
    24Monitor

    An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned

    MediumCVSS 6.1No exploitEPSS 0%

    brave · browserJun 30, 2023