May 2023
2,766 CVEs published, +17% on April 2023 and +25% on May 2022. CISA added 19 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 25911% of the 2,438 with a CVSS score
- Added to CISA KEV
- 198 of this month's CVEs are in KEV, listed a median 13.5 days after publication
- Vendors
- 1,3845,903 products
- Top weakness
- XSSCWE-79 · 462 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Openemr14911nonenew
- 2GoogleAndroid, Google Chrome, Chrome1391nonenew
- 3MavenCom.liferay.portal:release.portal.bom, Org.apache.inlong:manager-service, Org.apache.inlong:manager-pojo99152new
- 4IntelServer System M50CYP1UR212 Firmware, Server System M50CYP2UR208 Firmware, Server System D50TNP1MHCRAC Firmware940nonenew
- 5Ооо «ред Софт»Ред Ос9251new
- 6Ао "нппкт"Осон Основа Оnyx883nonenew
- 7UnknownAI Chatbot, Clock In Portal- Staff & Attendance Management, Product Catalog Feed By Pixelyoursite857nonenew
- 8Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition801nonenew
- 9ApplemacOS, iPadOS, iPhone OS714nonenew
- 10Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000660nonenew
- 11MicrosoftWindows 11 21h2, Windows 10 20h2, Windows 10 21h26132new
- 12SourcecodesterLost and Found Information System, Online Exam System, Online Computer and Laptop Store570nonenew
- 13PackagistPimcore/pimcore, Craftcms/cms, Thorsten/phpmyfaq513nonenew
- 14DebianDebian Linux480nonenew
- 15FedoraprojectFedora, Extra Packages For Enterprise Linux452nonenew
- 16Red HatRed Hat Enterprise Linux, Enterprise Linux, Red Hat Jboss Core Services385nonenew
- 17Ао «ивк»Альт 8 Сп, Альт Сп 10381nonenew
- 18JenkinsJenkins Saml Single Sign On(Sso) Plugin, Saml Single Sign On, Code Dx360nonenew
- 19GoGithub.com/kyverno/kyverno, Github.com/sigstore/rekor, Github.com/pydio/cells354nonenew
- 20IBMMq, Infosphere Information Server, Mq Appliance321nonenew
- 21SamsungAndroid, Samsung Blockchain Keystore, Galaxy Store3201new
- 22ApacheInlong, Streampark, Openmeetings31101new
- 23Apache Software FoundationApache Inlong, Inlong, Apache Streampark (Incubating)31101new
- 24PyPIVyper, Mlflow, Matrix-synapse315nonenew
- 25Samsung MobileSamsung Mobile Devices, Samsung Blockchain Keystore, Galaxy Store3101new
Severity
How this month's CVEs score on CVSS; 328 have no score yet. Severity is not exploitation.
- Critical259
- High796
- Medium1,274
- Low109
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS462
- CWE-787Out-of-bounds Write154
- CWE-89SQL Injection144
- CWE-352CSRF143
- CWE-20Improper Input Validation89
- CWE-22Path Traversal74
- CWE-120Buffer Overflow69
- CWE-125Out-of-bounds Read63
- CWE-77Command Injection55
- CWE-862Missing Authorization53
- CWE-863Incorrect Authorization51
- CWE-284Improper Access Control45
- CWE-78OS Command Injection41
- CWE-416Use After Free40
- CWE-434Unrestricted File Upload39
- CWE-276Incorrect Default Permissions35
- CWE-287Improper Authentication34
- CWE-400Resource Consumption34
- CWE-200Information Exposure29
- CWE-732Incorrect Permissions28
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins59117% of sector-tagged CVEs
- OSS Libraries38111% of sector-tagged CVEs
- Enterprise Software34010% of sector-tagged CVEs
- Operating Systems33210% of sector-tagged CVEs
- Hardware Firmware32710% of sector-tagged CVEs
- Mobile Apps2728% of sector-tagged CVEs
- Networking Infrastructure1815% of sector-tagged CVEs
- ICS / OT / IoT1545% of sector-tagged CVEs
- 7 smaller sectors516
- Not yet classified287
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 352CSRF | 20Improper Input Validation | 22Path Traversal | 120Buffer Overflow | 125Out-of-bounds Read | 77Command Injection | 862Missing Authorization |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 11 | 27 | 4 | 1 | 10 | 4 | 2 | ||
| 33 | 12 | 8 | 11 | 27 | ||||||
| Maven | 20 | 2 | 1 | 11 | 3 | 3 | 1 | 2 | ||
| Intel | 7 | 13 | 1 | 2 | 3 | |||||
| Ооо «ред Софт» | 6 | 26 | 2 | 1 | 1 | 6 | 3 | 1 | ||
| Ао «нппкт» | 7 | 1 | 1 | 3 | 1 | 1 | ||||
| Ооо «русбитех-астра» | 7 | 1 | 2 | 7 | 1 | 1 | ||||
| Apple | 8 | 2 | 8 | 6 | 1 | |||||
| Unisoc (Shanghai) Technologies Co., Ltd. | 22 | 8 | 3 | 26 | ||||||
| Microsoft Corp | 1 | 2 | 2 | |||||||
| Sourcecodester | 16 | 39 | ||||||||
| Microsoft | 2 | 2 |
CVEs published in May 2023
16 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-33009A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware versions 4.60 through 5.36 Patch 1, USG FLEX 5...KEV9.8
- CVE-2023-33010A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmware versions 4.50 through 5.36 Patch 1, USG FLEX ...KEV9.8
- CVE-2023-33246Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration functionKEV9.8
- CVE-2023-2868Remote Code injection in Barracuda Email Security GatewayKEV9.4
- CVE-2023-32315Openfire administration console authentication bypassKEV8.6
- CVE-2023-29336Win32k Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-24955Microsoft SharePoint Server Remote Code Execution VulnerabilityKEV7.2
- CVE-2023-21492Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR.KEV4.4
- CVE-2023-27823An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.9.8
- CVE-2023-31703Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.9.0
- CVE-2022-48244In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.7.8
- CVE-2022-45453TLS/SSL weak cipher suites enabled. The following products are affected: Acronis Cyber Protect 15 (Windows, Linux) before build 30984.7.5
- CVE-2023-27932This issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, tvOS 16.4, watchOS 9.4. Processing maliciously crafted web...5.5
- CVE-2023-2255Remote documents loaded without prompt via IFrame5.3
- CVE-2023-31699ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.4.8
- CVE-2022-48237In Image filter, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.4.4