Week 5, 2023

30 January – 5 February 2023

New CVEs: 459
Critical: 88
High: 162
Newly exploited: 2
Advisories: 149
Malicious pkgs: 150

Newly exploited 2

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2022-21587 KEV Feb 2, 2023 · ransomware Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected ar…
Oracle · Web Applications Desktop Integrator

EPSS 98%
High 8.8
CVE-2023-22952 KEV Feb 2, 2023 In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because of missing input validation.
EPSS 80%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2023-23076 OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
EPSS 74%
Critical 9.1
CVE-2023-0587 A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /o…
EPSS 60%
Critical 9.8
CVE-2023-25135 vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This o…
EPSS 24%
Critical 9.8
CVE-2022-4395 Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File Upload
EPSS 17%
Critical 9.4
CVE-2023-22501 An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain …
Atlassian · Jira Service Management Data Center · Jira Service Management Server

EPSS 16%
Critical 9.1
CVE-2022-42484 An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbit…
Siretta · FreshTomato · QUARTZ-GOLD · FreshTomato

EPSS 6.2%
Critical 9.8
CVE-2022-47003 A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
EPSS 3.7%
Critical 10.0
CVE-2023-23924 URI validation failure on SVG parsing in Dompdf
dompdf · dompdf

EPSS 3.7%
Critical 9.8
CVE-2022-45297 EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
EPSS 2.8%
Critical 9.8
CVE-2022-27596 Vulnerability in QTS
QNAP Systems · QTS · QuTS hero

EPSS 2.7%
Critical 9.8
CVE-2022-2329 A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote…
Schneider Electric · IGSS Data Server (IGSSdataServer.exe)

EPSS 2.3%
Critical 9.8
CVE-2023-24156 A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands…
EPSS 2.1%
Critical 9.8
CVE-2023-24151 A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary c…
EPSS 2.1%
Critical 9.8
CVE-2023-24153 A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitr…
EPSS 2.1%
Critical 9.8
CVE-2023-24152 A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary comma…
EPSS 2.1%

All 88 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

USN-5839-1 apache2 vulnerabilities 3 CVEs
ICSA-23-033-05 Delta Electronics DX-2100-L1-CN 2 CVEs
USN-5834-1 apache2 vulnerabilities 2 CVEs
ICSA-23-033-03 Baicells Nova 1 CVEs
ICSA-23-033-04 Delta Electronics DVW-W02W2-E2 1 CVEs