Week 37, 2023

11–17 September 2023

New CVEs: 508
Critical: 34
High: 156
Newly exploited: 8
Advisories: 289
Malicious pkgs: 62

Newly exploited 8

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 7.8
CVE-2023-26369 KEV Sep 14, 2023 [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild
Adobe · Acrobat Reader

EPSS 7.5%
High 8.8
CVE-2023-35674 KEV Sep 13, 2023 In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation …
Google · Android

EPSS 2.6%
High 8.8
CVE-2023-4863 KEV Sep 13, 2023 libwebp: OOB write in BuildHuffmanTable
Google · Chrome · libwebp

EPSS 100%
Medium 5.0
CVE-2023-20269 KEV Sep 13, 2023 · ransomware A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al…
Cisco · Cisco Firepower Threat Defense Software · Cisco Adaptive Security Appliance (ASA) Software

EPSS 27%
High 7.8
CVE-2023-36802 KEV Sep 12, 2023 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 28%
Medium 6.5
CVE-2023-36761 KEV Sep 12, 2023 Microsoft Word Information Disclosure Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise · Microsoft Office LTSC 2021 · Microsoft Office 2019

EPSS 20%
High 7.8
CVE-2023-41064 KEV Sep 11, 2023 A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.6.1 and iPadOS 16.6.1, macOS Monterey 12.6.9, macOS Ventura …
Apple · macOS · iOS and iPadOS

EPSS 53%
High 7.8
CVE-2023-41061 KEV Sep 11, 2023 A validation issue was addressed with improved logic. This issue is fixed in watchOS 9.6.2, iOS 16.6.1 and iPadOS 16.6.1. A maliciously crafted attachment may …
Apple · iOS and iPadOS · watchOS

EPSS 4.4%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2023-41892 Craft CMS Remote Code Execution vulnerability
craftcms · cms

EPSS 94%
Critical 9.8
CVE-2023-38204 Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8
Adobe · ColdFusion

EPSS 70%
Critical 9.9
CVE-2023-3710 Printer web page invalid command execution
Honeywell · PM23/43 · PM42 · PX45/65

EPSS 49%
Critical 9.8
CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack
OpenRefine · OpenRefine

EPSS 43%
Critical 9.8
CVE-2023-2071 FactoryTalk View Machine Edition Vulnerable to Remote Code Execution
Rockwell Automation · Fa

EPSS 17%
Critical 9.6
CVE-2023-36735 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Microsoft · Microsoft Edge (Chromium-based)

EPSS 2.1%
Critical 9.8
CVE-2023-3935 Wibu: Buffer Overflow in CodeMeter Runtime
Wibu · codemeter-runtime

EPSS 2%
Critical 9.1
CVE-2022-24093 Adobe Commerce post-auth improper input validation leads to remote code execution
Adobe · Adobe Commerce

EPSS 1.7%
Critical 9.8
CVE-2023-41331 SOFARPC Remote Command Execution (RCE) Vulnerability
sofastack · sofa-rpc

EPSS 1.6%
Critical 9.8
CVE-2023-30909 A remote authentication bypass issue exists in some OneView APIs.
Hewlett Packard Enterprise (HPE) · HPE OneView

EPSS 1.5%
Critical 9.8
CVE-2023-4662 RCE in Saphira Connect
Saphira · Saphira Connect

EPSS 1.3%
Critical 9.8
CVE-2023-40150 Softneta MedDream PACS Exposed Dangerous Method or Function
Softneta · MedDream PACS

EPSS 1.3%
Critical 9.8
CVE-2023-4669 Authentication Bypass in Exagate SYSGuard 3001
Exagate · SYSGuard 3001

EPSS 1.2%
Critical 9.8
CVE-2023-4661 SQLi in Saphira Connect
Saphira · Saphira Connect

EPSS 1%
Critical 9.1
CVE-2023-41256 Dover Fueling Solutions MAGLINK LX Console Authentication Bypass
Dover Fueling Solutions · MAGLINK LX Web Console Configuration

All 34 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2023-4863 libwebp: OOB write in BuildHuffmanTable
Google · Chrome · libwebp

EPSS 100%
High 7.5
CVE-2023-38205 ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298
Adobe · ColdFusion

EPSS 100%
High 8.0
CVE-2023-36745 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12 · Microsoft Exchange Server 2019 Cumulative Update 13

EPSS 76%
High 8.2
CVE-2023-42442 JumpServer session replays download without authentication
jumpserver · jumpserver

EPSS 63%
High 8.0
CVE-2023-36744 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12 · Microsoft Exchange Server 2019 Cumulative Update 13

EPSS 57%
High 7.5
CVE-2023-38039 When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. However, curl did not have…
curl · curl

EPSS 56%
Medium 5.7
CVE-2023-36777 Microsoft Exchange Server Information Disclosure Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12 · Microsoft Exchange Server 2019 Cumulative Update 13

EPSS 52%
High 8.0
CVE-2023-36756 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 12 · Microsoft Exchange Server 2019 Cumulative Update 13

EPSS 49%

Advisories

USN-6357-1 linux-ibm, linux-ibm-5.4 vulnerabilities 14 CVEs
USN-6339-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi vulnerabilities 8 CVEs
VDE-2023-031 Trumpf: Multiple Products affected by WIBU Codemeter Vulnerability 1 CVEs
MSRC-CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability 1 CVEs
MSRC-CVE-2023-38148 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability 1 CVEs
MSRC-CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability 1 CVEs
SSA-240541 SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products 1 CVEs
ICSA-23-257-06 Siemans WIBU Systems CodeMeter 1 CVEs