Week 16, 2023

17–23 April 2023

New CVEs: 543
Critical: 55
High: 152
Newly exploited: 6
Advisories: 162
Malicious pkgs: 30

Newly exploited 6

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2023-27350 KEV Apr 21, 2023 · ransomware This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir…
PaperCut · NG

EPSS 100%
Critical 9.6
CVE-2023-2136 KEV Apr 21, 2023 Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a s…
Google · Chrome

EPSS 5.8%
High 7.5
CVE-2023-28432 KEV Apr 21, 2023 Minio Information Disclosure in Cluster Deployment
minio · minio

EPSS 84%
High 8.8
CVE-2017-6742 KEV Apr 19, 2023 A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute cod…
Cisco · IntelliShield · Cisco IOS XE Software · Universal Product

EPSS 21%
High 8.8
CVE-2023-2033 KEV Apr 17, 2023 Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…
Google · Chrome

EPSS 41%
High 7.8
CVE-2019-8526 KEV Apr 17, 2023 A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated …
Apple · macOS

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2023-27350 This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not requir…
PaperCut · NG

EPSS 100%
Critical 10.0
CVE-2023-29525 Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform
xwiki · xwiki-platform

EPSS 78%
Critical 10.0
CVE-2023-29524 Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform
xwiki · xwiki-platform

EPSS 76%
Critical 9.8
CVE-2023-30547 Sandbox Escape in vm2
patriksimek · vm2

EPSS 73%
Critical 10.0
CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
EPSS 71%
Critical 9.8
CVE-2023-20864 VMware Aria Operations for Logs contains a deserialization vulnerability. An unauthenticated, malicious actor with network access to VMware Aria Operations for…
EPSS 70%
Critical 9.9
CVE-2023-29516 Code injection from view right on XWiki.AttachmentSelector in xwiki-platform
xwiki · xwiki-platform

EPSS 66%
Critical 9.1
CVE-2023-2227 Improper Authorization in modoboa/modoboa
modoboa · modoboa/modoboa

EPSS 44%
Critical 9.6
CVE-2023-2136 Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a s…
Google · Chrome

EPSS 5.8%
Critical 10.0
CVE-2021-33970 Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.
EPSS 3.1%
Critical 9.8
CVE-2023-2231 MAXTECH MAX-G866ac Remote Management missing authentication
MAXTECH · MAX-G866ac

EPSS 2%
Critical 10.0
CVE-2023-29523 Code injection in display method used in user profiles in xwiki-platform
xwiki · xwiki-platform

EPSS 2%
Critical 9.1
CVE-2023-29519 Code injection in org.xwiki.platform:xwiki-platform-attachment-ui
xwiki · xwiki-platform

EPSS 1.9%
Critical 10.0
CVE-2023-29514 Code injection in template provider administration in xwiki-platform
xwiki · xwiki-platform

EPSS 1.9%
Critical 10.0
CVE-2023-29510 Code injection via unescaped translations in xwiki-platform
xwiki · xwiki-platform

EPSS 1.9%

All 55 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories

DSA-5393-1 chromium - security update 5 CVEs
DLA-3398-1 curl - security update 4 CVEs
ICSA-23-108-02 Schneider Electric APC Easy UPS Online Monitoring Software (Update A) 3 CVEs
WID-SEC-2023-1061 VMware Aria Operations for Logs: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administratorrechten 2 CVEs
WID-SEC-2023-1060 NetApp ActiveIQ Unified Manager: Schwachstelle ermöglicht Denial of Service 1 CVEs
USN-6036-1 patchelf vulnerability 1 CVEs
ICSA-23-110-01 INEA ME RTU 1 CVEs
WID-SEC-2023-1042 Ruby: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 1 CVEs