Week 42, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2023-20198 Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list …

  Cisco · Cisco IOS XE Software

  EPSS 100%
• Critical 9.8
  CVE-2023-34051 VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system…
  EPSS 48%
• Critical 9.8
  CVE-2023-5642 Advantech R-SeeNet Unauthenticated Read/Write

  Advantech · R-SeeNet

  EPSS 18%
• Critical 9.8
  CVE-2023-5204 AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

  Quantum Cloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

  EPSS 7.8%
• Critical 9.8
  CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
  EPSS 3.8%
• Critical 9.6
  CVE-2023-42627 Liferay Portal and Liferay DXP Vulnerable to XSS in the Commerce Module

  Liferay · DXP · Portal

  EPSS 2.8%
• Critical 9.0
  CVE-2023-42628 Liferay Portal and Liferay DXP Vulnerable to XSS in the Wiki Widget

  Liferay · DXP · Portal

  EPSS 2.8%
• Critical 9.0
  CVE-2023-42629 Liferay Portal and Liferay DXP Vulnerable to Stored XSS in the Manage Vocabulary Page

  Liferay · DXP · Portal

  EPSS 2.8%
• Critical 9.6
  CVE-2023-5241 AI ChatBot <= 4.8.9 and 4.9.2 - Authenticated (Subscriber+) Directory Traversal to Arbitrary File Write via qcld_openai_upload_pagetraining_file

  Quantum Cloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

  EPSS 2.6%
• Critical 9.8
  CVE-2020-36706 Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Upload

  simplepress · Simple:Press Forum

  EPSS 2.2%
• Critical 10.0
  CVE-2023-3991 OS command injection vulnerability in FreshTomato 2023.3

  FreshTomato · FreshTomato

  EPSS 2.1%
• Critical 9.6
  CVE-2023-5212 AI ChatBot <= 4.8.9 and 4.9.2- Authenticated (Subscriber+) Arbitrary File Deletion via qcld_openai_delete_training_file

  Quantum Cloud · WPBot – AI ChatBot for Live Support, Lead Generation, AI Services

  EPSS 2%
• Critical 9.1
  CVE-2023-45278 Yamcs API Directory Traversal vulnerability
  EPSS 1.8%
• Critical 9.1
  CVE-2023-45685 Arbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers

  South River Technologies · Titan SFTP · Titan MFT

  EPSS 1.7%
• Critical 9.1
  CVE-2023-21413 Remote code execution vulnerability during the installation of ACAP applications on the Axis device

  Axis Communications AB · AXIS OS

  EPSS 1.5%

All 39 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2023-38545 This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow th…

  curl · curl

  EPSS 78%
• Medium 6.1
  CVE-2023-5631 Stored XSS vulnerability in Roundcube

  Roundcube · Roundcubemail

  EPSS 76%
• High 7.5
  CVE-2023-39456 Apache Traffic Server: Malformed http/2 frames can cause an abort

  Apache Software Foundation · Apache Traffic Server

  EPSS 58%
• High 8.8
  CVE-2023-46229 LangChain Server Side Request Forgery vulnerability
  EPSS 42%
• Unscored
  CVE-2023-45375 In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModu…
  EPSS 41%
• High 8.0
  CVE-2023-35180 SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

  SolarWinds · Access Rights Manager

  EPSS 29%
• High 7.5
  CVE-2023-5003 Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure
  EPSS 27%
• Medium 4.7
  CVE-2023-5684 Byzoro Smart S85F Management Platform importexport.php os command injection

  Byzoro · Smart S85F Management Platform

  EPSS 27%