Week 32, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.4
  CVE-2023-3824 Buffer overflow and overread in phar_dir_read()

  PHP Group · PHP

  EPSS 22%
• Critical 9.8
  CVE-2023-3452 Canto <= 3.0.4 - Unauthenticated Remote File Inclusion

  flightbycanto · Canto

  EPSS 7%
• Critical 9.8
  CVE-2023-37483 Improper Access Control Vulnerabilities in SAP PowerDesigner

  SAP · SAP PowerDesigner

  EPSS 4.8%
• Critical 9.8
  CVE-2023-36910 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 2.5%
• Critical 9.8
  CVE-2023-35385 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 2.5%
• Critical 9.1
  CVE-2023-38208 Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

  Adobe · Magento Commerce

  EPSS 2.5%
• Critical 9.8
  CVE-2023-21709 Microsoft Exchange Server Elevation of Privilege Vulnerability

  Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12 · Microsoft Exchange Server 2019 Cumulative Update 13

  EPSS 2%
• Critical 9.6
  CVE-2023-3526 PHOENIX CONTACT: Cross-site Scripting vulnerability in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT devices

  Phoenix Contact · TC CLOUD CLIENT 1002-4G ATT · TC ROUTER 3002T-4G VZW · CLOUD CLIENT 1101T-TX/TX

  EPSS 1.8%
• Critical 9.8
  CVE-2023-36911 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 1.7%
• Critical 9.1
  CVE-2023-39526 PrestaShopSQL manager vulnerability (potential RCE)

  PrestaShop · PrestaShop

  EPSS 1.7%
• Critical 9.3
  CVE-2023-36534 Path traversal in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.

  Zoom Video Communications · Zoom Desktop Client for Windows

  EPSS 1.6%
• Critical 9.1
  CVE-2023-33934 Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies

  Apache Software Foundation · Apache Traffic Server

  EPSS 1.6%
• Critical 9.6
  CVE-2023-33242 Lindell17 TSS Abort Mishandling

  Lindell TSS Implementations · Wallet

  EPSS 1.5%
• Critical 9.6
  CVE-2023-39213 Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an…

  Zoom Video Communications · Zoom Desktop Client for Windows and Zoom VDI Client

  EPSS 1.4%
• Critical 9.8
  CVE-2023-39532 SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution

  endojs · endo

  EPSS 1.3%

All 46 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2023-32560 An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thank…

  ivanti · Avalanche

  EPSS 99%
• High 8.8
  CVE-2023-32563 An unauthenticated attacker could achieve the code execution through a RemoteControl server.

  ivanti · Avalanche

  EPSS 89%
• High 8.8
  CVE-2023-36899 ASP.NET Elevation of Privilege Vulnerability

  Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

  EPSS 77%
• Unscored
  CVE-2023-32782 A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions coul…
  EPSS 56%
• Medium 6.8
  CVE-2023-32562 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove …

  ivanti · Avalanche

  EPSS 46%
• Medium 6.8
  CVE-2023-32564 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove …

  ivanti · Avalanche

  EPSS 44%
• High 8.8
  CVE-2023-37569 OS Command Injection Vulnerability in Emagic Data Center Management Suite

  ESDS · Emagic Data Center Management Suite

  EPSS 34%
• Unscored
  CVE-2023-38925 Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi.
  EPSS 15%