Week 51, 2023

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-46216 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Wavelink

  EPSS 36%
• Critical 9.8
  CVE-2023-41727 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Wavelink

  EPSS 36%
• Critical 9.8
  CVE-2023-46217 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Wavelink

  EPSS 36%
• Critical 9.8
  CVE-2023-46261 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 11%
• Critical 9.8
  CVE-2023-46220 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 11%
• Critical 9.8
  CVE-2023-46257 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 11%
• Critical 9.8
  CVE-2023-46259 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 11%
• Critical 9.8
  CVE-2023-46225 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 11%
• Critical 9.8
  CVE-2023-46222 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 6.8%
• Critical 9.8
  CVE-2023-46221 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 6.8%
• Critical 9.8
  CVE-2023-46223 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 6.8%
• Critical 9.8
  CVE-2023-46224 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 6.8%
• Critical 9.8
  CVE-2023-46258 An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of Service (DoS) or c…

  ivanti · Avalanche

  EPSS 6.8%
• Critical 10.0
  CVE-2023-6977 Path Traversal: '\..\filename'

  MLflow · mlflow/mlflow

  EPSS 3.9%
• Critical 9.3
  CVE-2023-50254 Deepin Reader RCE vulnerability due to a design flaw

  linuxdeepin · developer-center

  EPSS 2.1%

All 76 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.9
  CVE-2023-48795 Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin
  EPSS 94%
• High 7.3
  CVE-2021-22962 An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.

  ivanti · Avalanche

  EPSS 91%
• High 7.2
  CVE-2023-46264 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove …

  ivanti · Avalanche

  EPSS 90%
• High 7.5
  CVE-2023-6909 Path Traversal: '\..\filename' in mlflow/mlflow

  MLflow · mlflow/mlflow

  EPSS 90%
• High 7.5
  CVE-2023-46262 An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control serve…

  ivanti · Avalanche

  EPSS 83%
• High 7.2
  CVE-2023-46263 An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote …

  ivanti · Avalanche

  EPSS 82%
• High 8.8
  CVE-2023-49085 Cacti SQL Injection vulnerability

  Cacti · cacti

  EPSS 74%
• High 7.2
  CVE-2023-38126 Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability

  Softing · edgeAggregator

  EPSS 71%