Week 4, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-23897 Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE

  Jenkins Project · Jenkins

  EPSS 100%
• Critical 9.8
  CVE-2024-0204 Authentication Bypass in GoAnywhere MFT

  Fortra · GoAnywhere MFT

  EPSS 95%
• Critical 9.8
  CVE-2024-22729 NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
  EPSS 71%
• Critical 9.8
  CVE-2023-36177 An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request…
  EPSS 28%
• Critical 9.8
  CVE-2024-22651 There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
  EPSS 20%
• Critical 9.6
  CVE-2024-23625 D-Link DAP-1650 SUBSCRIBE Callback Command Injection Vulnerability

  D-Link · DAP-1650

  EPSS 7.3%
• Critical 9.6
  CVE-2024-23624 D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability

  D-Link · DAP-1650

  EPSS 7.1%
• Critical 9.9
  CVE-2024-0402 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

  GitLab · GitLab

  EPSS 3.8%
• Critical 9.0
  CVE-2024-23627 Motorola MR2600 SaveStaticRouteIPv4Params Command Injection Vulnerability

  Motorola · MR2600

  EPSS 3.5%
• Critical 9.0
  CVE-2024-23626 Motorola MR2600 SaveSysLogParams Command Injection Vulnerability

  Motorola · MR2600

  EPSS 3.5%
• Critical 9.0
  CVE-2024-23628 Motorola MR2600 SaveStaticRouteIPv6Params Command Injection Vulnerability

  Motorola · MR2600

  EPSS 3.2%
• Critical 9.8
  CVE-2023-51887 Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL.
  EPSS 2.5%
• Critical 9.9
  CVE-2024-20253 A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbit…

  Cisco · Cisco Unified Communications Manager · Cisco Unity Connection · Cisco Unified Contact Center Express

  EPSS 2.4%
• Critical 10.0
  CVE-2024-23616 Symantec Server Management Suite Buffer Overflow

  Symantec · Server Management Suite

  EPSS 1.9%
• Critical 10.0
  CVE-2024-23615 Symantec Messaging Gateway Buffer Overflow

  Symantec · Messaging Gateway

  EPSS 1.9%

All 66 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2023-52251 An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topi…
  EPSS 87%
• High 8.8
  CVE-2024-23898 Cross-site WebSocket hijacking vulnerability in the Jenkins CLI

  Jenkins Project · Jenkins

  EPSS 67%
• Medium 6.5
  CVE-2024-23638 SQUID-2023:11 Denial of Service in Cache Manager

  squid-cache · squid

  EPSS 60%
• Medium 4.7
  CVE-2024-0986 Issabel PBX Asterisk-Cli os command injection

  Issabel Foundation · PBX

  EPSS 58%
• Medium 6.3
  CVE-2024-0939 Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload

  Byzoro · Smart S210 Management Platform

  EPSS 44%
• Medium 6.5
  CVE-2023-41474 Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.reso…
  EPSS 38%
• Medium 4.7
  CVE-2024-0921 D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection

  D-Link · DIR-816 A2

  EPSS 38%
• High 8.0
  CVE-2024-0778 Uniview ISC 2500-S VM.php setNatConfig os command injection

  Uniview · ISC 2500-S

  EPSS 32%