Week 22, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-34362 In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerabi…
  EPSS 100%
• Critical 9.8
  CVE-2022-24629 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir …
  EPSS 37%
• Critical 9.8
  CVE-2023-33735 D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interf…
  EPSS 32%
• Critical 9.8
  CVE-2022-24627 An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_…
  EPSS 26%
• Critical 9.8
  CVE-2023-30149 SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1…
  EPSS 17%
• Critical 9.8
  CVE-2023-34152 A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.
  EPSS 8%
• Critical 9.8
  CVE-2021-45039 Multiple models of the Uniview IP Camera (e.g., IPC_G6103 B6103.16.10.B25.201218, IPC_G61, IPC21, IPC23, IPC32, IPC36, IPC62, and IPC_HCMN) offer an undocument…
  EPSS 4.2%
• Critical 9.6
  CVE-2023-28347 An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions similarly …
  EPSS 2.8%
• Critical 9.8
  CVE-2023-33669 Tenda AC8V4.0-V16.03.34.06 was discovered to contain a stack overflow via the timeZone parameter in the sub_44db3c function.
  EPSS 2.1%
• Critical 9.8
  CVE-2023-33476 ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handlin…
  EPSS 2.1%
• Critical 9.8
  CVE-2022-35744 Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 2%
• Critical 9.1
  CVE-2023-33193 Emby Server Proxy Header Spoofing Vulnerability

  EmbySupport · security

  EPSS 1.7%
• Critical 9.7
  CVE-2023-33965 Brook's tproxy server is vulnerable to a drive-by command injection.

  txthinking · brook

  EPSS 1.6%
• Critical 9.8
  CVE-2023-33975 RIOT-OS vulnerable to Out of Bounds Write in _rbuf_add

  RIOT-OS · RIOT

  EPSS 1.5%
• Critical 9.8
  CVE-2023-29746 An issue found in The Thaiger v.1.2 for Android allows unauthorized apps to cause a code execution attack by manipulating the SharedPreference files.
  EPSS 1.4%

All 58 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2023-30253 Dolibarr vulnerable to remote code execution via uppercase manipulation
  EPSS 82%
• High 8.8
  CVE-2023-32707 ‘edit_user’ Capability Privilege Escalation

  Splunk · Splunk Enterprise · Splunk Cloud Platform

  EPSS 79%
• Medium 6.5
  CVE-2023-2650 Possible DoS translating ASN.1 object identifiers

  OpenSSL · OpenSSL

  EPSS 75%
• Medium 4.8
  CVE-2023-28651 Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administ…

  Contec · CONPROSYS HMI System(CHS)

  EPSS 62%
• Medium 4.6
  CVE-2023-34220 In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible

  JetBrains · TeamCity

  EPSS 61%
• Medium 4.6
  CVE-2023-34225 In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible

  JetBrains · TeamCity

  EPSS 61%
• High 7.5
  CVE-2022-35748 HTTP.sys Denial of Service Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 47%
• High 8.0
  CVE-2022-45938 An issue was discovered in Comcast Defined Technologies microeisbss through 2021. An attacker can inject a stored XSS payload in the Device ID field under Inve…
  EPSS 45%