July 2023
2,380 CVEs published, −3% on June 2023 and +8% on July 2022. CISA added 16 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 27512% of the 2,301 with a CVSS score
- Added to CISA KEV
- 1613 of this month's CVEs are in KEV, listed a median 0 days after publication
- Vendors
- 1,1644,071 products
- Top weakness
- XSSCWE-79 · 324 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Open Babel152311new
- 2GoogleAndroid, Chrome, Google Chrome1464nonenew
- 3MicrosoftWindows Server 2022 (Server Core Installation), Windows Server 2022, Windows Server 201914355new
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition94101new
- 5Ао "нппкт"Осон Основа Оnyx876nonenew
- 6MavenCom.mabl.integration.jenkins:mabl-integration, Org.jenkins-ci.plugins:dimensionsscm, Org.apache.ambari:ambari8621nonenew
- 7Ао «ивк»Альт Сп 10, Альт 8 Сп, Альт Рабочая Станция К799nonenew
- 8Ооо «ред Софт»Ред Ос764nonenew
- 9Red HatRed Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9724nonenew
- 10MilesightUR32L Firmware, UR32L, Milesightvpn691nonenew
- 11UnknownMstore API, An_gradebook, Eventon614nonenew
- 12Unisoc (Shanghai) Technologies Co., Ltd.Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8000, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8001, Sc9863a/sc9832e/sc7731e/t610/t310/t606/t760/t610/t618/t606/t612/t616/t760/t770/t820/s8004590nonenew
- 13ApplemacOS, iPhone OS, iOS and iPadOS5752new
- 14OracleMySQL Server, Oracle Graalvm For Jdk, Graalvm572nonenew
- 15FedoraprojectFedora, Extra Packages For Enterprise Linux481nonenew
- 16IBMDB2, DB2 For Linux, Unix and Windows, Cloud Pak For Data460nonenew
- 17PyPIPaddlepaddle, Apache-airflow, Ethyca-fides467nonenew
- 18Ао «нтц Ит Роса»Роса Хром, Rosa Virtualization 3.0, Роса Кобальт444nonenew
- 19PackagistPimcore/pimcore, Nilsteampassnet/teampass, Getkirby/cms402nonenew
- 20LinuxLinux Kernel, Kernel399nonenew
- 21SamsungAndroid, Pass, Smart Switch Pc390nonenew
- 22Fedora ProjectFedora380nonenew
- 23Samsung MobileSamsung Mobile Devices, Samsung Pass, Calendar380nonenew
- 24DebianDebian Linux370nonenew
- 25NetappActive Iq Unified Manager, Oncommand Insight, H500S358nonenew
Severity
How this month's CVEs score on CVSS; 79 have no score yet. Severity is not exploitation.
- Critical275
- High751
- Medium1,117
- Low158
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS324
- CWE-787Out-of-bounds Write181
- CWE-352CSRF130
- CWE-89SQL Injection121
- CWE-862Missing Authorization89
- CWE-20Improper Input Validation71
- CWE-125Out-of-bounds Read64
- CWE-416Use After Free61
- CWE-12154
- CWE-22Path Traversal50
- CWE-863Incorrect Authorization49
- CWE-78OS Command Injection47
- CWE-434Unrestricted File Upload44
- CWE-200Information Exposure41
- CWE-94Code Injection41
- CWE-400Resource Consumption36
- CWE-77Command Injection34
- CWE-120Buffer Overflow32
- CWE-287Improper Authentication26
- CWE-122Heap Buffer Overflow24
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins52717% of sector-tagged CVEs
- Operating Systems46915% of sector-tagged CVEs
- Enterprise Software36111% of sector-tagged CVEs
- OSS Libraries36111% of sector-tagged CVEs
- Mobile Apps2759% of sector-tagged CVEs
- Hardware Firmware1956% of sector-tagged CVEs
- ICS / OT / IoT1786% of sector-tagged CVEs
- Networking Infrastructure1485% of sector-tagged CVEs
- 7 smaller sectors519
- Not yet classified137
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 352CSRF | 89SQL Injection | 862Missing Authorization | 20Improper Input Validation | 125Out-of-bounds Read | 416Use After Free | 121 | 22Path Traversal |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 9 | 16 | 2 | 9 | 9 | 16 | 3 | |||
| 19 | 56 | 3 | 6 | 11 | ||||||
| Microsoft | 5 | 1 | 10 | 15 | 10 | 1 | ||||
| Microsoft Corp | 5 | 10 | 15 | 10 | 1 | |||||
| Ооо «русбитех-астра» | 5 | 7 | 1 | 6 | 8 | 14 | 1 | |||
| Ао «нппкт» | 5 | 9 | 1 | 7 | 7 | 16 | 1 | |||
| Maven | 6 | 12 | 2 | 11 | 2 | 5 | ||||
| Ао «ивк» | 1 | 3 | 2 | 8 | 10 | 1 | ||||
| Ооо «ред Софт» | 8 | 7 | 1 | 2 | 1 | 2 | 14 | |||
| Milesight | 46 | 1 | 46 | 2 | ||||||
| PyPI | 5 | 12 | 2 | 4 | 2 | 3 | ||||
| Unisoc (Shanghai) Technologies Co., Ltd. | 3 | 52 | 1 |
CVEs published in July 2023
21 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-24489A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthenticated attacker to remotely compromise the customer-manag...KEV9.8
- CVE-2023-29300Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionKEV9.8
- CVE-2023-35078An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication.KEV9.8
- CVE-2023-3519Unauthenticated remote code executionKEV9.8
- CVE-2023-38203Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEKEV9.8
- CVE-2023-34192Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.KEV9.0
- CVE-2023-32049Windows SmartScreen Security Feature Bypass VulnerabilityKEV8.8
- CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityKEV8.8
- CVE-2023-37450The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9.6. Processing web content may lead to arbitrar...KEV8.8
- CVE-2023-32046Windows MSHTML Platform Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-36874Windows Error Reporting Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2023-29298Adobe ColdFusion Improper Access Control Security feature bypassKEV7.5
- CVE-2023-36884Windows Search Remote Code Execution VulnerabilityKEV7.5
- CVE-2023-37580Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.KEV6.1
- CVE-2023-38606This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and iPadOS 15.7.8, iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Big Sur 11.7.9, macOS...KEV5.5
- CVE-2023-36808GLPI vulnerable to SQL injection through Computer Virtual Machine information8.6
- CVE-2023-32629Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_setxattr on Ubuntu kernels7.8
- CVE-2023-3668Improper Encoding or Escaping of Output in froxlor/froxlor7.2
- CVE-2023-3878Campcodes Beauty Salon Management System about-us.php sql injection6.3
- CVE-2023-30226An issue was discovered in function get_gnu_verneed in rizinorg Rizin prior to 0.5.0 verneed_entry allows attackers to cause a denial of service via crafted elf file.5.5
- CVE-2023-3977Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation function4.3