February 2023
2,562 CVEs published, −2% on January 2023 and +25% on February 2022. CISA added 14 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 26112% of the 2,186 with a CVSS score
- Added to CISA KEV
- 149 of this month's CVEs are in KEV, listed a median 4 days after publication
- Vendors
- 1,0955,937 products
- Top weakness
- XSSCWE-79 · 288 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1UnknownSimple Urls, Shoplentor, Intuitive Custom Post Order1563nonenew
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Gss-ntlmssp1326nonenew
- 3GoogleAndroid, Chrome, Google Chrome1061nonenew
- 4MicrosoftWindows 10 1809, Windows 10 20h2, Windows 10 21h29374new
- 5Ао "нппкт"Осон Основа Оnyx8731new
- 6Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Common Edition, Astra Linux Special Edition Для «эльбрус»8521new
- 7IntelXeon Gold 6312u Firmware, Xeon Gold 5320t Firmware, Xeon Gold 5320h Firmware740nonenew
- 8Ооо «ред Софт»Ред Ос724nonenew
- 9DellPowerscale Onefs, Emc Powerscale Onefs, Supportassist For Home Pcs680nonenew
- 10SourcecodesterDoctors Appointment System, Music Gallery Site, Online Pizza Ordering System610nonenew
- 11Red HatRed Hat Enterprise Linux, Red Hat Satellite, Enterprise Linux5941new
- 12PackagistThorsten/phpmyfaq, Wallabag/wallabag, Pimcore/pimcore583nonenew
- 13ApplemacOS, iPhone OS, iPadOS5631new
- 14Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000500nonenew
- 15MavenOrg.jenkins-ci.plugins:azure-credentials, Org.jeecgframework.boot:jeecg-boot-base, Org.jenkins-ci.plugins:email-ext486nonenew
- 16SiemensSolid Edge SE2022, Solid Edge SE2023, Tecnomatix Plant Simulation461nonenew
- 17npmSequelize, @sequelize/core, Undici454nonenew
- 18GoGithub.com/answerdev/answer, Github.com/rancher/rancher, Github.com/pion/dtls/v24410nonenew
- 19Ао «ивк»Альт 8 Сп, Альт Сп 10, Альт Рабочая Станция К423nonenew
- 20Novell Inc.Opensuse Leap, Suse Linux Enterprise Server For Sap Applications, Suse Linux Enterprise Server402nonenew
- 21FortinetFortiweb, Fortinac, Fortios384nonenew
- 22IBMInfosphere Information Server, Sterling B2B Integrator Standard Edition, Sterling B2B Integrator3721new
- 23Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization, Rosa Virtualization 3.0372nonenew
- 24HPEAruba Mobility Conductor (Formerly Mobility Master); Aruba Mobility Controllers; Wlan Gateways and SD-WAN Gateways Managed By Aruba Central, Serviceguard For Linux, HPE Serviceguard For Linux369nonenew
- 25PyPIModoboa, Markdown-it-py, Apache-airflow-providers-google344nonenew
Severity
How this month's CVEs score on CVSS; 376 have no score yet. Severity is not exploitation.
- Critical261
- High790
- Medium1,049
- Low86
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS288
- CWE-787Out-of-bounds Write146
- CWE-89SQL Injection146
- CWE-77Command Injection82
- CWE-125Out-of-bounds Read76
- CWE-20Improper Input Validation67
- CWE-352CSRF66
- CWE-200Information Exposure57
- CWE-22Path Traversal57
- CWE-284Improper Access Control45
- CWE-862Missing Authorization45
- CWE-400Resource Consumption37
- CWE-416Use After Free37
- CWE-78OS Command Injection36
- CWE-12132
- CWE-434Unrestricted File Upload30
- CWE-122Heap Buffer Overflow29
- CWE-306Missing Auth for Critical Function27
- CWE-502Deserialization27
- CWE-94Code Injection27
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins45215% of sector-tagged CVEs
- OSS Libraries41714% of sector-tagged CVEs
- Enterprise Software39713% of sector-tagged CVEs
- Operating Systems38012% of sector-tagged CVEs
- Hardware Firmware31910% of sector-tagged CVEs
- Mobile Apps2227% of sector-tagged CVEs
- Networking Infrastructure2227% of sector-tagged CVEs
- ICS / OT / IoT1194% of sector-tagged CVEs
- 7 smaller sectors389
- Not yet classified154
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 77Command Injection | 125Out-of-bounds Read | 20Improper Input Validation | 352CSRF | 200Information Exposure | 22Path Traversal | 284Improper Access Control |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 2 | 14 | 3 | 1 | 12 | 4 | 1 | 3 | 2 | |
| 16 | 7 | 4 | 7 | 1 | 1 | |||||
| Microsoft Corp | 7 | 2 | 2 | 8 | 3 | 2 | ||||
| Ао «нппкт» | 1 | 10 | 7 | 4 | 1 | 1 | ||||
| Ооо «русбитех-астра» | 1 | 11 | 7 | 4 | 3 | 1 | ||||
| Microsoft | 7 | 2 | 2 | 9 | 3 | 2 | ||||
| Intel | 1 | 2 | 4 | 4 | 1 | |||||
| Ооо «ред Софт» | 3 | 4 | 1 | 1 | 4 | 3 | 3 | 1 | 2 | |
| Dell | 2 | 3 | 2 | 3 | 1 | 1 | 5 | |||
| Sourcecodester | 10 | 42 | 2 | 3 | ||||||
| Packagist | 23 | 1 | 1 | 2 | 4 | 1 | ||||
| Red Hat Inc. | 1 | 8 | 1 | 1 | 7 | 2 | 2 |
CVEs published in February 2023
16 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2022-47986IBM Aspera Faspex code executionKEV9.8
- CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin?login_username=admin&password=password$(curl substring.KEV9.8
- CVE-2023-21529Microsoft Exchange Server Remote Code Execution VulnerabilityKEV8.8
- CVE-2023-23529A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing malicious...KEV8.8
- CVE-2023-21823Windows Graphics Component Remote Code Execution VulnerabilityKEV7.8
- CVE-2023-23376Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2022-24990TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/api.php?mobile/webNasIPS and then reading the PWD field in...KEV7.5
- CVE-2023-21715Microsoft Publisher Security Feature Bypass VulnerabilityKEV7.3
- CVE-2023-0669Fortra GoAnywhere MFT License Response Servlet Command InjectionKEV7.2
- CVE-2023-23752[20230201] - Core - Improper access check in webservice endpointsKEV5.3
- CVE-2020-21120SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_cart parameter to /index.php/cart/num.9.8
- CVE-2022-4492The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and...7.5
- CVE-2022-47768Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.7.5
- CVE-2023-1046MuYuCMS getFile.html server-side request forgery6.3
- CVE-2021-37376Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to run arbitrary code via the Friendly Name field in System ...5.4
- CVE-2022-3891WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access5.3