August 2023
2,549 CVEs published, +7% on July 2023 and +5% on August 2022. CISA added 8 to KEV.
2023 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2023 | January 2023: 2,619 CVEs5 added to CISA KEV | February 2023: 2,562 CVEs14 added to CISA KEV | March 2023: no snapshot | April 2023: 2,356 CVEs17 added to CISA KEV | May 2023: 2,766 CVEs19 added to CISA KEV | June 2023: 2,448 CVEs24 added to CISA KEV | July 2023: 2,380 CVEs16 added to CISA KEV | August 2023: 2,549 CVEs8 added to CISA KEV | September 2023: 2,863 CVEs19 added to CISA KEV | October 2023: 2,764 CVEs18 added to CISA KEV | November 2023: 2,560 CVEs18 added to CISA KEV | December 2023: 2,769 CVEs11 added to CISA KEV | 28,63611 of 12 months11/12 |
- Critical
- 35214% of the 2,490 with a CVSS score
- Added to CISA KEV
- 812 of this month's CVEs are in KEV, listed a median 88 days after publication
- Vendors
- 1,2768,146 products
- Top weakness
- XSSCWE-79 · 410 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Poppler20123nonenew
- 2Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition15310nonenew
- 3GoogleAndroid, Chrome, Google Chrome1444nonenew
- 4Ао "нппкт"Осон Основа Оnyx1367nonenew
- 5DebianDebian Linux986nonenew
- 6IntelRaid Web Console 3 (RWC3), Realsense 450 Fa Firmware, Proset\/wireless Wifi9611nonenew
- 7Ооо «ред Софт»Ред Ос9613nonenew
- 8MicrosoftWindows 11 22h2, Windows 11 21h2, Windows 10 22h28941new
- 9FedoraprojectFedora, Fedora Linux Kernel8241new
- 10Ао «ивк»Альт Сп 10, Альт 8 Сп7210nonenew
- 11Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 67051new
- 12TendaAC6 Firmware, AC8 Firmware, AC9 Firmware6553nonenew
- 13MavenOrg.jenkins-ci.plugins:fortify, Org.jenkins-ci.plugins:cloudbees-folder, Org.graylog2:graylog2-server588nonenew
- 14PhpjabbersDocument Creator, Callback Widget, Time Slots Booking Calendar5623nonenew
- 15Ао «нтц Ит Роса»Роса Хром, Роса Кобальт, Rosa Virtualization 3.0513nonenew
- 16UnknownMultiparcels Shipping For Woocommerce, Tiempo.com, Simple Blog Card501nonenew
- 17PyPILangchain, Apache-airflow, Gitpython4712nonenew
- 18Fedora ProjectFedora454nonenew
- 19PackagistCockpit-hq/cockpit, Prestashop/prestashop, Wallabag/wallabag454nonenew
- 20BroadcomRaid Controller Web Interface, Lsi Storage Authority (Lsa), Brocade Fabric Operating System3911nonenew
- 21Camunda Services GmbhCamunda Modeler391nonenew
- 22AdobeAcrobat, Acrobat Dc, Acrobat Reader371nonenew
- 23CiscoPrime Infrastructure, Cisco Evolved Programmable Network Manager, Cisco Prime Infrastructure371nonenew
- 24GoGithub.com/answerdev/answer, Github.com/mattermost/mattermost-server/v6, Github.com/gravitl/netmaker370nonenew
- 25npm@excalidraw/excalidraw, Matrix-appservice-irc, Find-exec364nonenew
Severity
How this month's CVEs score on CVSS; 59 have no score yet. Severity is not exploitation.
- Critical352
- High909
- Medium1,152
- Low77
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS410
- CWE-787Out-of-bounds Write224
- CWE-89SQL Injection159
- CWE-20Improper Input Validation89
- CWE-22Path Traversal83
- CWE-120Buffer Overflow81
- CWE-125Out-of-bounds Read79
- CWE-78OS Command Injection77
- CWE-416Use After Free71
- CWE-77Command Injection55
- CWE-284Improper Access Control46
- CWE-862Missing Authorization37
- CWE-200Information Exposure36
- CWE-434Unrestricted File Upload35
- CWE-400Resource Consumption34
- CWE-287Improper Authentication32
- CWE-863Incorrect Authorization30
- CWE-269Improper Privilege Mgmt27
- CWE-94Code Injection26
- CWE-476NULL Pointer Dereference25
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems49314% of sector-tagged CVEs
- Web & CMS Plugins46713% of sector-tagged CVEs
- OSS Libraries44813% of sector-tagged CVEs
- Enterprise Software36710% of sector-tagged CVEs
- Networking Infrastructure2868% of sector-tagged CVEs
- Hardware Firmware2647% of sector-tagged CVEs
- Mobile Apps2326% of sector-tagged CVEs
- ICS / OT / IoT1895% of sector-tagged CVEs
- Security Products1494% of sector-tagged CVEs
- 6 smaller sectors449
- Not yet classified228
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 787Out-of-bounds Write | 89SQL Injection | 20Improper Input Validation | 22Path Traversal | 120Buffer Overflow | 125Out-of-bounds Read | 78OS Command Injection | 416Use After Free | 77Command Injection |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 5 | 30 | 3 | 3 | 6 | 8 | 10 | 22 | 4 | |
| Ооо «русбитех-астра» | 31 | 1 | 2 | 8 | 13 | 22 | ||||
| 1 | 34 | 3 | 1 | 11 | 20 | 1 | ||||
| Ао «нппкт» | 1 | 25 | 1 | 1 | 1 | 5 | 12 | 23 | ||
| Debian | 1 | 16 | 1 | 3 | 5 | 12 | 13 | |||
| Intel | 2 | 1 | 12 | 2 | ||||||
| Ооо «ред Софт» | 2 | 10 | 1 | 1 | 4 | 4 | 7 | |||
| Fedoraproject | 12 | 3 | 3 | 2 | 13 | 12 | ||||
| Microsoft | 8 | 9 | 1 | 2 | 11 | 1 | ||||
| Microsoft Corp | 2 | 1 | 9 | 2 | 11 | 1 | ||||
| Ао «ивк» | 15 | 1 | 5 | 9 | 4 | |||||
| Tenda | 55 | 4 | 3 | 3 |
CVEs published in August 2023
20 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the application without proper authentication. Th...KEV9.8
- CVE-2023-36845Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variableKEV9.8
- CVE-2023-38035A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication controls on the administrative interface du...KEV9.8
- CVE-2023-41265An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, ...KEV9.6
- CVE-2022-48503The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to ar...KEV8.8
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and Augus...KEV8.2
- CVE-2023-38831RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because a ZIP archive may include a benign fil...KEV7.8
- CVE-2023-38180.NET and Visual Studio Denial of Service VulnerabilityKEV7.5
- CVE-2023-38950A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in v...KEV7.5
- CVE-2023-4346 KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the d...KEV7.5
- CVE-2023-35081A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticated administrator to write arbitrary files onto the applia...KEV7.2
- CVE-2023-36844Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variablesKEV5.3
- CVE-2023-36846Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesKEV5.3
- CVE-2023-36847Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesKEV5.3
- CVE-2022-39987A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the "entity" POST parameters in /ajax/networking/get_wgkey...8.8
- CVE-2022-48597A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allo...8.8
- CVE-2023-34552In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP multicast protocol can allow an unauthenticated attacker p...8.8
- CVE-2023-39003OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /tmp.7.5
- CVE-2022-4953Elementor < 3.5.5 - Iframe Injection6.1
- CVE-2023-4111PHP Jabbers Bus Reservation System index.php cross site scripting4.3