Week 3, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2023-22527 A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected inst…

  Atlassian · Confluence Server · Confluence Data Center

  EPSS 100%
• Critical 9.8
  CVE-2022-1609 The School Management < 9.9.7 - Unauthenticated RCE via REST api
  EPSS 64%
• Critical 9.8
  CVE-2023-6623 Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
  EPSS 51%
• Critical 9.8
  CVE-2023-0224 GiveWP < 2.24.1 - Unauthenticated SQLi
  EPSS 3.7%
• Critical 9.8
  CVE-2024-0705 Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection

  ThemeHigh · Payment Gateway of Stripe for WooCommerce

  EPSS 2.6%
• Critical 9.8
  CVE-2023-6816 Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 2.1%
• Critical 10.0
  CVE-2021-4434 Social Warfare <= 3.5.2 - Remote Code Execution

  Warfare Plugins · Social Sharing Plugin – Social Warfare

  EPSS 1.9%
• Critical 9.8
  CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

  Apache Software Foundation · Apache IoTDB

  EPSS 1.9%
• Critical 9.8
  CVE-2023-27168 An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp file.
  EPSS 1.3%
• Critical 9.8
  CVE-2024-23730 Unsafe yaml deserialization in llama-hub
  EPSS 1.2%
• Critical 9.8
  CVE-2024-0552 Intumit inc. SmartRobot - Remote Code Execution

  INTUMIT · SmartRobot

  EPSS 1.2%
• Critical 9.8
  CVE-2024-23731 Code execution in Embedchain
  EPSS 1.1%
• Critical 9.8
  CVE-2023-3211 WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection
  EPSS 1%
• Critical 9.8
  CVE-2023-50694 An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in the parser.nim compo…
  EPSS 1%
• Critical 9.1
  CVE-2024-22317 IBM App Connect Enterprise denial of service

  IBM · App Connect Enterprise

  EPSS 1%

All 48 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 5.3
  CVE-2024-0769 D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal

  D-Link · DIR-859

  EPSS 83%
• Medium 5.4
  CVE-2023-5914   Cross-site scripting (XSS)

  Cloud Software Group · Citrix StoreFront

  EPSS 75%
• High 7.2
  CVE-2024-0200 Unsafe Reflection in Github Enterprise Server leading to Command Injection

  GitHub · Enterprise Server

  EPSS 72%
• Medium 6.5
  CVE-2023-50290 Apache Solr: Host environment variables are published via the Metrics API

  Apache Software Foundation · Apache Solr

  EPSS 68%
• Medium 6.5
  CVE-2024-0507 Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

  GitHub · Enterprise Server

  EPSS 66%
• High 8.2
  CVE-2023-6549 Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and Out…

  Cloud Software Group · NetScaler ADC

  EPSS 58%
• Medium 5.0
  CVE-2023-6184 Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting

  Cloud Software Group · Citrix Session Recording

  EPSS 47%
• Medium 5.3
  CVE-2024-0235 EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure
  EPSS 38%