Week 36, 2023

4–10 September 2023

New CVEs: 585
Critical: 30
High: 167
Newly exploited: 1
Advisories: 134
Malicious pkgs: 13

Newly exploited 1

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2023-33246 KEV Sep 6, 2023 Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function
Apache Software Foundation · Apache RocketMQ

EPSS 97%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2023-39361 Unauthenticated SQL Injection in graph_view.php in Cacti
Cacti · cacti

EPSS 89%
Critical 9.8
CVE-2023-4634 Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution
dglingren · Media Library Assistant

EPSS 86%
Critical 10.0
CVE-2023-20238 A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform cou…
Cisco · Cisco BroadWorks

EPSS 15%
Critical 9.8
CVE-2023-40743 Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService
Apache Software Foundation · Apache Axis

EPSS 3.3%
Critical 9.8
CVE-2023-4613 Upload Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
LG Electronics · LG LED Assistant

EPSS 2.5%
Critical 9.8
CVE-2023-4614 setThumbnailRC Directory Path Traversal Allows Unauthenticated Arbitrary File Read Vulnerability
LG Electronics · LG LED Assistant

EPSS 2.5%
Critical 9.1
CVE-2021-36023 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Adobe · Adobe Commerce

EPSS 2.3%
Critical 9.8
CVE-2023-41330 Unsafe deserialization in knplabs/knp-snappy
KnpLabs · snappy

EPSS 2.3%
Critical 9.8
CVE-2023-30908 A remote authentication bypass issue exists in a OneView API.
Hewlett Packard Enterprise (HPE) · HPE OneView

EPSS 1.4%
Critical 9.9
CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD
argoproj · Argo CD

EPSS 1.2%
Critical 10.0
CVE-2023-39967 Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio
wiremock · wiremock

EPSS 1%
Critical 9.9
CVE-2023-39424 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dll
Resort Data Processing · IRM Next Generation
Critical 9.8
CVE-2023-42276 hutool Buffer Overflow vulnerability
Critical 9.8
CVE-2023-42277 hutool Buffer Overflow vulnerability
Critical 9.8
CVE-2023-42268 Jeecg boot SQL Injection vulnerability

All 30 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Low 3.8
CVE-2023-39265 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections
Apache Software Foundation · Apache Superset

EPSS 86%
High 7.2
CVE-2023-39362 Authenticated command injection in SNMP options of a Device
Cacti · cacti

EPSS 85%
High 7.8
CVE-2023-41064 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura …
Apple · macOS · iOS and iPadOS

EPSS 53%
High 8.8
CVE-2023-4762 Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security s…
Google · Chrome

EPSS 41%
Medium 6.6
CVE-2023-37941 Apache Superset: Metadata db write access can lead to remote code execution
Apache Software Foundation · Apache Superset

EPSS 35%
High 7.5
CVE-2023-39584 Hexo `include_code` has a path traversal
EPSS 35%
High 7.2
CVE-2023-4528 JSCAPE MFT Server Unsafe Deserialization on Management Port
Redwood Software · JSCAPE MFT Server

EPSS 32%
Medium 5.0
CVE-2023-20269 A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al…
Cisco · Cisco Firepower Threat Defense Software · Cisco Adaptive Security Appliance (ASA) Software

EPSS 27%

Advisories

USN-6347-1 linux-azure-fde-5.15 vulnerabilities 24 CVEs
USN-6338-2 linux-gcp, linux-gcp-6.2, linux-ibm, linux-oracle, linux-starfive vulnerabilities 11 CVEs
USN-6338-1 linux, linux-aws, linux-aws-6.2, linux-hwe-6.2, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-6.2, linux-raspi vulnerabilities 11 CVEs
USN-6340-2 linux-azure-5.4, linux-gcp-5.4, linux-gkeop, linux-raspi, linux-raspi-5.4, linux-xilinx-zynqmp vulnerabilities 9 CVEs
USN-6349-1 linux-azure vulnerabilities 9 CVEs
USN-6340-1 linux, linux-aws, linux-aws-5.4, linux-gcp, linux-hwe-5.4, linux-iot, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities 9 CVEs
USN-6339-2 linux-gcp-5.15, linux-gkeop-5.15 vulnerabilities 8 CVEs
USN-6351-1 linux-gke, linux-gkeop vulnerabilities 8 CVEs
USN-6350-1 linux-aws, linux-aws-5.15, linux-ibm-5.15, linux-oracle, linux-oracle-5.15 vulnerabilities 8 CVEs
USN-6339-1 linux, linux-gcp, linux-hwe-5.15, linux-ibm, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities 8 CVEs