Weekly digest

Week 11, 2023 (13–19 Mar)

8 new CVEs this week, in line with the recent average. Severity skewed high: 3 critical and 1 high, 50% of the total. One arrived with exploitation evidence or public exploit code already attached. No new KEV entries.

New CVEs

Critical

KEV additions

Records changed

New this week, ranked by depth score

The 8 that matter most of the 8 published.

CVE-2023-28461Critical· 9.8CISA KEV

3y ago

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could…

▾ Hadalarraynetworks · arrayos_agEPSS 68%via NVD

CVE-2023-28531Critical· 9.8

3y ago

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints

ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9.

▾ Midnightopenbsd · opensshEPSS 2.3%via NVD

CVE-2023-27582Critical· 9.1

3y ago

Full authentication bypass if SASL authorization username is specified

▾ Midnightfoxcpp · github.com/foxcpp/maddyEPSS 1.0%via OSV

CVE-2023-1390High· 7.5

3y ago

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module

A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module. The while loop in tipc_link_xmit() hits an unknown state while attempting to parse SKBs, which are not in the queue. Sending two small UDP packe…

▾ TwilightEPSS 5.1%via CVEORG

CVE-2023-28607Medium· 6.1

3y ago