April 2023
2,356 CVEs published, +12% on April 2022. CISA added 17 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 28412% of the 2,307 with a CVSS score
- Added to CISA KEV
- 1717 of this month's CVEs are in KEV, listed a median 36 days after publication
- Vendors
- 1,0884,249 products
- Top weakness
- XSSCWE-79 · 412 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1MicrosoftWindows Server 2022, Windows Server 2022 (Server Core Installation), Windows Server 2019 (Server Core Installation)11244new
- 2Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Xwiki Platform10215nonenew
- 3GoogleAndroid, Google Chrome, Chrome10122new
- 4SourcecodesterOnline Computer and Laptop Store, Vehicle Service Management System, Online Payroll System980nonenew
- 5MavenOrg.xwiki.platform:xwiki-platform-oldcore, Tech.powerjob:powerjob, Org.xwiki.platform:xwiki-platform-web-templates9440nonenew
- 6OracleMySQL Server, Vm VirtualBox, Graalvm Enterprise Edition920nonenew
- 7PackagistPimcore/pimcore, Thorsten/phpmyfaq, Concrete5/concrete5918nonenew
- 8Ао "нппкт"Осон Основа Оnyx8123new
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition7713new
- 10Ао «ивк»Альт 8 Сп, Альт Сп 10652nonenew
- 11AdobeSubstance 3d Stager, Acrobat Dc, Acrobat Reader571nonenew
- 12FedoraprojectFedora, Extra Packages For Enterprise Linux5412new
- 13UnknownW4 Post List, Simple Giveaways, Gallery By Bestwebsoft542nonenew
- 14Ооо «ред Софт»Ред Ос545nonenew
- 15DebianDebian Linux4812new
- 16LinuxLinux Kernel430nonenew
- 17CiscoCisco Small Business RV Series Router Firmware, RV320 Firmware, Cisco Small Business RV3254201new
- 18Oretnom23Online Computer and Laptop Store, Service Provider Management System, Ac Repair and Services System400nonenew
- 19NvidiaVirtual Gpu, Nvidia Dgx Servers, Studio R530380nonenew
- 20XwikiXwiki, Xwiki-platform, Xwiki-commons3827nonenew
- 21CampcodesAdvanced Online Voting System, Coffee Shop Pos System, Online Thesis Archiving System370nonenew
- 22npmVM2, @strapi/plugin-users-permissions, @openzeppelin/contracts-upgradeable379nonenew
- 23Red HatRed Hat Enterprise Linux, Enterprise Linux, Openshift Serverless3721new
- 24PyPIApache-superset, Modoboa, Wagtail3461new
- 25Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Кобальт, Роса Хром340nonenew
Severity
How this month's CVEs score on CVSS; 49 have no score yet. Severity is not exploitation.
- Critical284
- High711
- Medium1,184
- Low128
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS412
- CWE-89SQL Injection183
- CWE-787Out-of-bounds Write174
- CWE-125Out-of-bounds Read85
- CWE-20Improper Input Validation51
- CWE-22Path Traversal51
- CWE-416Use After Free48
- CWE-77Command Injection45
- CWE-400Resource Consumption44
- CWE-434Unrestricted File Upload43
- CWE-352CSRF42
- CWE-78OS Command Injection41
- CWE-284Improper Access Control37
- CWE-190Integer Overflow36
- CWE-269Improper Privilege Mgmt35
- CWE-287Improper Authentication35
- CWE-863Incorrect Authorization35
- CWE-120Buffer Overflow33
- CWE-94Code Injection33
- CWE-476NULL Pointer Dereference32
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins62019% of sector-tagged CVEs
- OSS Libraries44814% of sector-tagged CVEs
- Enterprise Software40713% of sector-tagged CVEs
- Operating Systems37311% of sector-tagged CVEs
- Networking Infrastructure2829% of sector-tagged CVEs
- Hardware Firmware1806% of sector-tagged CVEs
- Mobile Apps1264% of sector-tagged CVEs
- 8 smaller sectors640
- Not yet classified179
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 125Out-of-bounds Read | 20Improper Input Validation | 22Path Traversal | 416Use After Free | 77Command Injection | 400Resource Consumption | 434Unrestricted File Upload |
|---|---|---|---|---|---|---|---|---|---|---|
| Microsoft Corp | 3 | 4 | 4 | 8 | 1 | 9 | 2 | |||
| Сообщество Свободного Программного Обеспечения | 3 | 1 | 12 | 4 | 3 | 3 | 10 | 2 | 3 | |
| Microsoft | 3 | 1 | 4 | 8 | 9 | 2 | ||||
| 22 | 10 | 1 | 1 | 6 | 1 | |||||
| Sourcecodester | 23 | 66 | 1 | 3 | ||||||
| Maven | 15 | 3 | 1 | 1 | 1 | 2 | 1 | |||
| Oracle Corp. | 3 | |||||||||
| Oracle | 3 | |||||||||
| Oracle Corporation | 3 | |||||||||
| Packagist | 44 | 7 | 3 | 3 | 1 | 4 | ||||
| Ао «нппкт» | 10 | 4 | 2 | 2 | 13 | 4 | ||||
| Ооо «русбитех-астра» | 15 | 3 | 1 | 1 | 14 | 1 |
CVEs published in April 2023
22 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution of arbitrary code.KEV9.8
- CVE-2023-27350This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The ...KEV9.8
- CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, ...KEV9.8
- CVE-2023-29492Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.KEV9.8
- CVE-2023-2136Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page....KEV9.6
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYKEV8.9
- CVE-2022-43769Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)KEV8.8
- CVE-2023-2033Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)KEV8.8
- CVE-2023-28205A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.4.1, iOS 15.7.5 and iPadOS 15.7.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1. Process...KEV8.8
- CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization DecisionsKEV8.6
- CVE-2023-28206An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15...KEV8.6
- CVE-2023-28252Windows Common Log File System Driver Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-27351This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The ...KEV7.5
- CVE-2023-29552The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow the attacker to use spoofed UDP traffic to conduct a denial...KEV7.5
- CVE-2023-28229Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityKEV7.0
- CVE-2023-20118A vulnerability in the web-based management interface of Cisco Small Business Routers RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could allow an authenticated, remote attacker to execute ...KEV6.5
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensi...KEV4.9
- CVE-2023-26083Memory leak vulnerability in Mali GPU Kernel Driver in Midgard GPU Kernel Driver all versions from r6p0 - r32p0, Bifrost GPU Kernel Driver all versions from r0p0 - r42p0, Valhall GPU Kernel Driver ...KEV3.3
- CVE-2023-28121An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a...9.8
- CVE-2023-29186Directory/Path Traversal vulnerability in SAP NetWeaver.8.7
- CVE-2023-28459pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.6.5
- CVE-2023-22729Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen 5.4