Week 33, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2023-35082 An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the applica…

  ivanti · EPMM

  EPSS 100%
• Critical 9.8
  CVE-2023-36845 Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

  Juniper Networks · Junos OS

  EPSS 95%
• Critical 9.8
  CVE-2023-2917 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

  Rockwell Automation · ThinManager® ThinServer™

  EPSS 72%
• Critical 9.8
  CVE-2023-29468 The Texas Instruments (TI) WiLink WL18xx MCP driver does not limit the number of information elements (IEs) of type XCC_EXT_1_IE_ID or XCC_EXT_2_IE_ID that can…
  EPSS 10%
• Critical 9.9
  CVE-2023-37914 Privilege escalation (PR)/RCE from account through Invitation subject/message

  xwiki · xwiki-platform

  EPSS 1.9%
• Critical 9.8
  CVE-2023-38896 LangChain vulnerable to arbitrary code execution
  EPSS 1.8%
• Critical 9.1
  CVE-2023-3267 When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitizat…

  CyberPower · PowerPanel Enterprise

  EPSS 1.8%
• Critical 9.8
  CVE-2023-38894 tree-kit Prototype Pollution vulnerability
  EPSS 1.7%
• Critical 9.8
  CVE-2023-39293 A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute …
  EPSS 1.7%
• Critical 9.8
  CVE-2023-3265 An authentication bypass exists on CyberPower PowerPanel Enterprise by failing to sanitize meta-characters from the username, allowing an attacker to login int…

  CyberPower · PowerPanel Enterprise

  EPSS 1.6%
• Critical 9.8
  CVE-2023-39659 LangChain vulnerable to arbitrary code execution
  EPSS 1.5%
• Critical 9.8
  CVE-2023-39662 llama-index vulnerable to arbitrary code execution
  EPSS 1.5%
• Critical 9.8
  CVE-2023-40069 OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a…

  ELECOM · WRC-1750GHBK · WRC-F1167ACF · WRC-1750GHBK-E

  EPSS 1.5%
• Critical 9.8
  CVE-2023-39667 D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the FUN_0000acb4 function.
  EPSS 1.4%
• Critical 9.8
  CVE-2023-39661 PandasAI vulnerable to arbitrary code execution
  EPSS 1.4%

All 27 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2023-36846 Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  Juniper Networks · Junos OS

  EPSS 93%
• Medium 5.3
  CVE-2023-36844 Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

  Juniper Networks · Junos OS

  EPSS 90%
• Medium 5.3
  CVE-2023-36847 Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

  Juniper Networks · Junos OS

  EPSS 83%
• Unscored
  CVE-2023-26469 In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
  EPSS 83%
• High 7.5
  CVE-2023-2915 Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

  Rockwell Automation · ThinManager® ThinServer™

  EPSS 82%
• High 7.6
  CVE-2023-4347 Cross-site Scripting (XSS) - Reflected in librenms/librenms

  librenms · librenms/librenms

  EPSS 70%
• Medium 4.9
  CVE-2023-40028 Arbitrary file read via symlinks in Ghost

  TryGhost · Ghost

  EPSS 66%
• High 7.3
  CVE-2023-4415 Ruijie RG-EW1200G login improper authentication

  Ruijie · RG-EW1200G

  EPSS 58%