Week 5, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-22320 IBM Operational Decision Manager code execution

  IBM · Operational Decision Manager

  EPSS 73%
• Critical 9.8
  CVE-2023-48793 Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
  EPSS 7%
• Critical 9.8
  CVE-2023-48792 Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
  EPSS 7%
• Critical 9.8
  CVE-2024-24329 TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules functio…
  EPSS 6.2%
• Critical 9.8
  CVE-2024-23052 An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson…
  EPSS 4.9%
• Critical 9.8
  CVE-2024-23653 BuildKit interactive containers API does not validate entitlements check

  moby · BuildKit

  EPSS 4.1%
• Critical 10.0
  CVE-2024-23652 BuildKit possible host system access from mount stub cleaner

  moby · BuildKit

  EPSS 2.5%
• Critical 9.4
  CVE-2024-23832 Mastodon Remote user impersonation and takeover

  mastodon · mastodon

  EPSS 2.5%
• Critical 9.8
  CVE-2023-6943 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.…

  Mitsubishi Electric · GX Works3 · GX Works2 · GT Designer3 Version1 (GOT2000)

  EPSS 2.1%
• Critical 9.8
  CVE-2024-25089 Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes.
  EPSS 1.8%
• Critical 9.8
  CVE-2024-1015 Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3

  SE-elektronic · E-DDC3.3

  EPSS 1.8%
• Critical 9.8
  CVE-2024-24332 TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilterRules function.
  EPSS 1.7%
• Critical 9.8
  CVE-2024-24325 TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function.
  EPSS 1.7%
• Critical 9.8
  CVE-2024-24333 TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAclRules function.
  EPSS 1.7%
• Critical 9.8
  CVE-2024-24327 TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIpv6Cfg function.
  EPSS 1.6%

All 53 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.2
  CVE-2024-21893 A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons …

  ivanti · ICS · IPS

  EPSS 100%
• High 8.8
  CVE-2024-21888 A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privil…

  ivanti · ICS · IPS

  EPSS 85%
• Medium 5.9
  CVE-2024-23334 aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal

  aio-libs · aiohttp

  EPSS 77%
• High 8.1
  CVE-2024-22319 IBM Operational Decision Manager JDNI injection

  IBM · Operational Decision Manager

  EPSS 76%
• Medium 6.5
  CVE-2024-21388 Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

  Microsoft · Microsoft Edge (Chromium-based)

  EPSS 36%
• Medium 6.3
  CVE-2024-1021 Rebuild HTTP Request readRawText server-side request forgery
  EPSS 35%
• High 8.8
  CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation

  minio · minio

  EPSS 34%
• High 7.2
  CVE-2023-5372 The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(A…

  Zyxel · NAS326 firmware · NAS542 firmware

  EPSS 28%