Week 4, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2022-31706 The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp…
  EPSS 87%
• Critical 9.8
  CVE-2022-31704 The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an…
  EPSS 81%
• Critical 9.8
  CVE-2022-4305 Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin
  EPSS 39%
• Critical 9.8
  CVE-2023-23560 In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
  EPSS 14%
• Critical 9.3
  CVE-2022-47615 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File Inclusion

  ThimPress · LearnPress – WordPress LMS Plugin

  EPSS 5.2%
• Critical 9.8
  CVE-2022-40222 An OS command injection vulnerability exists in the m2m DELETE_FILE cmd functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted networ…

  Siretta · QUARTZ-GOLD

  EPSS 4.4%
• Critical 9.9
  CVE-2022-45808 WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL Injection

  ThimPress · LearnPress – WordPress LMS Plugin

  EPSS 4.4%
• Critical 9.8
  CVE-2022-42493 Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea…

  Siretta · QUARTZ-GOLD

  EPSS 3.5%
• Critical 9.8
  CVE-2022-42490 Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea…

  Siretta · QUARTZ-GOLD

  EPSS 3.5%
• Critical 9.8
  CVE-2022-42492 Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea…

  Siretta · QUARTZ-GOLD

  EPSS 3.4%
• Critical 9.8
  CVE-2022-42491 Several OS command injection vulnerabilities exist in the m2m binary of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network request can lea…

  Siretta · QUARTZ-GOLD

  EPSS 3.4%
• Critical 9.8
  CVE-2022-48108 D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allow…
  EPSS 3.1%
• Critical 9.8
  CVE-2022-48107 D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows…
  EPSS 3.1%
• Critical 9.8
  CVE-2022-25894 Remote Code Execution in com.bstek.uflo:uflo-core
  EPSS 2.7%
• Critical 9.8
  CVE-2022-48066 An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
  EPSS 2.5%

All 57 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.2
  CVE-2022-41142 This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili…

  Centreon · Centreon

  EPSS 85%
• High 7.5
  CVE-2022-3736 named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries

  ISC · BIND 9

  EPSS 48%
• High 7.3
  CVE-2023-0562 PHPGurukul Bank Locker Management System Login index.php sql injection

  PHPGurukul · Bank Locker Management System

  EPSS 44%
• Medium 6.1
  CVE-2023-0448 The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting v…
  EPSS 43%
• Low 3.5
  CVE-2023-0563 PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting

  PHPGurukul · Bank Locker Management System

  EPSS 38%
• Medium 6.7
  CVE-2022-29844 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp

  Western Digital · My Cloud

  EPSS 36%
• High 8.8
  CVE-2022-4230 WP Statistics < 13.2.9 - Authenticated SQLi
  EPSS 36%
• High 7.5
  CVE-2023-22960 Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
  EPSS 28%