Week 29, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-3519 Unauthenticated remote code execution

  Citrix · NetScaler ADC  · NetScaler Gateway

  EPSS 100%
• Critical 9.8
  CVE-2023-38203 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

  Adobe · ColdFusion

  EPSS 97%
• Critical 9.8
  CVE-2023-38408 The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forward…
  EPSS 80%
• Critical 10.0
  CVE-2023-3765 Absolute Path Traversal in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 67%
• Critical 9.8
  CVE-2023-37265 Incorrect identification of source IP addresses in CasaOS

  IceWhale Tech · CasaOS-Gateway

  EPSS 7.4%
• Critical 9.8
  CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS

  IceWhale Tech · CasaOS

  EPSS 6.8%
• Critical 9.8
  CVE-2023-37903 Sandbox Escape in vm2

  patriksimek · vm2

  EPSS 4.2%
• Critical 9.1
  CVE-2023-34034 Access Control Bypass in Spring Security
  EPSS 4.1%
• Critical 9.1
  CVE-2023-38428 An issue was discovered in the Linux kernel before 6.3.4. fs/ksmbd/smb2pdu.c in ksmbd does not properly check the UserName value because it does not consider t…
  EPSS 3.2%
• Critical 9.8
  CVE-2021-37384 RCE (Remote Code Execution) vulnerability was found in some Furukawa ONU models, this vulnerability allows remote unauthenticated users to send arbitrary comma…
  EPSS 1.7%
• Critical 9.1
  CVE-2023-30799 MikroTik RouterOS Administrator Privilege Escalation

  MikroTik · RouterOS

  EPSS 1.4%
• Critical 9.8
  CVE-2023-26512 Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted data

  Apache Software Foundation · Apache EventMesh (incubating) RabbitMQ connector

  EPSS 1.4%
• Critical 9.8
  CVE-2023-37292 HGiga iSherlock - Command Injection

  HGiga · iSherlock 5.5 · iSherlock 4.5

  EPSS 1.3%
• Critical 9.1
  CVE-2023-37471 User impersonation using SAMLv1.x SSO in Open Access Management

  OpenIdentityPlatform · OpenAM

  EPSS 1.3%
• Critical 9.8
  CVE-2023-38427 An issue was discovered in the Linux kernel before 6.3.8. fs/smb/server/smb2pdu.c in ksmbd has an integer underflow and out-of-bounds read in deassemble_neg_co…
  EPSS 1.2%

All 42 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2023-38646 Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privi…
  EPSS 99%
• High 7.5
  CVE-2023-22047 Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.59 and 8.60…

  Oracle · PeopleSoft Enterprise PT PeopleTools

  EPSS 77%
• Medium 6.3
  CVE-2023-3836 Dahua Smart Park Management unrestricted upload

  Dahua · Smart Park Management

  EPSS 74%
• High 7.5
  CVE-2023-34966 Samba: infinite loop in mdssvc rpc service for spotlight

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 62%
• Medium 5.3
  CVE-2023-34967 Samba: type confusion in mdssvc rpc service for spotlight

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 61%
• High 7.2
  CVE-2023-35086 ASUS RT-AX56U V2 & RT-AC86U - Format String -1

  ASUS · RT-AC86U · RT-AX56U_V2

  EPSS 39%
• Medium 4.7
  CVE-2023-3852 OpenRapid RapidCMS upload.php unrestricted upload

  OpenRapid · RapidCMS

  EPSS 25%
• Unscored
  CVE-2023-37645 eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
  EPSS 25%