Weekly digest
Week 35, 2023 (28 Aug – 3 Sep)
13 new CVEs this week, in line with the recent average. Severity skewed high: 1 critical and 10 high, 85% of the total. 3 arrived with exploitation evidence or public exploit code already attached. No new KEV entries. neovim was the most-affected vendor with 3.
New this week, ranked by depth score
The 12 that matter most of the 13 published.
CVE-2023-41265Critical· 9.6CISA KEVPoCAn HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier all…
CVE-2023-41266High· 8.2CISA KEVPoCA path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an un…
A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows an un…
CVE-2023-4346High· 7.5CISA KEVKNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device
KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the device…
CVE-2023-27604High· 8.8Airflow Sqoop Provider RCE Vulnerability
Airflow Sqoop Provider RCE Vulnerability
CVE-2023-4751High· 7.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1331.
CVE-2023-4738High· 7.8Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.1848.
CVE-2023-4736High· 7.8Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
CVE-2023-4735High· 7.8Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
Out-of-bounds Write in GitHub repository vim/vim prior to 9.0.1847.
CVE-2023-4734High· 7.8Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
Integer Overflow or Wraparound in GitHub repository vim/vim prior to 9.0.1846.
CVE-2023-40590High· 7.8GitPython untrusted search path on Windows systems leading to arbitrary code execution
GitPython untrusted search path on Windows systems leading to arbitrary code execution
CVE-2023-4611High· 7.0A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel
A use-after-free flaw was found in mm/mempolicy.c in the memory management subsystem in the Linux Kernel. This issue is caused by a race between mbind() and VMA-locked page fault, and may allow a local attacker to crash the system or lea…
CVE-2023-39968Medium· 6.1Open Redirect Vulnerability in jupyter-server
Open Redirect Vulnerability in jupyter-server
Most-affected vendors
By CVEs published in the period.