Week 34, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-38035 A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass authentication contr…

  ivanti · MobileIron Sentry

  EPSS 100%
• Critical 9.1
  CVE-2023-40176 SXSS in the user profile via the timezone displayer

  xwiki · xwiki-platform

  EPSS 80%
• Critical 9.8
  CVE-2023-36281 langchain vulnerable to arbitrary code execution
  EPSS 3.4%
• Critical 9.8
  CVE-2023-32002 The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. This vulnerability af…

  Node.js · node

  EPSS 1.6%
• Critical 9.8
  CVE-2023-39809 N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system_hostname parameter…
  EPSS 1.5%
• Critical 9.8
  CVE-2023-40571 weblogic-framework Deserialization of Untrusted Data vulnerability

  dream0x01 · weblogic-framework

  EPSS 1.4%
• Critical 9.1
  CVE-2023-40573 XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution

  xwiki · xwiki-platform

  EPSS 1.1%
• Critical 9.9
  CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields

  xwiki · xwiki-platform

  EPSS 1.1%
• Critical 9.9
  CVE-2023-25915 Authenticated Remote Command Execution in Danfoss AK-SM800A

  Danfoss · AK-SM800A

  EPSS 1%
• Critical 9.8
  CVE-2023-4419 The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or disrupt the functiona…

  SICK · LMS5xx

• Critical 9.8
  CVE-2023-32757 e-Excellence U-Office Force - Arbitrary File Upload

  e-Excellence · U-Office Force

• Critical 9.8
  CVE-2023-40904 Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at /goform/setMacFi…
• Critical 9.8
  CVE-2023-4404 Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalation

  smub · Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More

• Critical 9.0
  CVE-2023-41028 Juplink RX4-1500 Stack-based Buffer Overflow Vulnerability

  Juplink · RX4-1500

• Critical 9.8
  CVE-2023-4373 Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a …

  Devolutions · Remote Desktop Manager

All 19 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.8
  CVE-2023-38831 RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. The issue occurs because …
  EPSS 100%
• Medium 6.3
  CVE-2023-4542 D-Link DAR-8000-10 sys1.php os command injection

  D-Link · DAR-8000-10

  EPSS 85%
• Unscored
  CVE-2023-38836 File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.
  EPSS 76%
• Low 3.5
  CVE-2023-4547 SPA-Cart eCommerce CMS search cross site scripting

  SPA-Cart · eCommerce CMS

  EPSS 60%
• Medium 4.6
  CVE-2023-41249 In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step

  JetBrains · TeamCity

  EPSS 56%
• Unscored
  CVE-2023-4427 Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML…

  Google · Chrome

  EPSS 48%
• Medium 6.3
  CVE-2023-4548 SPA-Cart eCommerce CMS GET Parameter search sql injection

  SPA-Cart · eCommerce CMS

  EPSS 29%
• Unscored
  CVE-2023-39026 Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a cr…
  EPSS 18%