Week 6, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-46359 An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbi…
  EPSS 88%
• Critical 9.6
  CVE-2024-21762 A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6…

  Fortinet · FortiOS · FortiProxy

  EPSS 85%
• Critical 9.7
  CVE-2024-23108 An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized…

  Fortinet · FortiSIEM

  EPSS 80%
• Critical 9.8
  CVE-2023-6989 Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

  paultgoodchild · Shield: Blocks Bots, Protects Users, and Prevents Security Breaches

  EPSS 57%
• Critical 9.8
  CVE-2024-23917 In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

  JetBrains · TeamCity

  EPSS 54%
• Critical 9.8
  CVE-2024-22836 An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute s…
  EPSS 30%
• Critical 9.8
  CVE-2024-24496 An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, update-tracker.php…
  EPSS 20%
• Critical 9.8
  CVE-2021-4436 3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload
  EPSS 6.6%
• Critical 9.8
  CVE-2024-22853 D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a te…
  EPSS 4.8%
• Critical 9.8
  CVE-2024-24112 xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
  EPSS 3.4%
• Critical 9.7
  CVE-2024-23109 An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized…

  Fortinet · FortiSIEM

  EPSS 3.3%
• Critical 9.8
  CVE-2024-1207 Booking Calendar <= 9.9 - Unauthenticated SQL Injection

  wpdevelop · Booking Calendar

  EPSS 3.2%
• Critical 9.6
  CVE-2023-48974 Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script to the serverName_…
  EPSS 3%
• Critical 9.8
  CVE-2024-24398 Stimulsoft Dashboard.JS directory traversal vulnerability
  EPSS 2%
• Critical 9.8
  CVE-2024-24321 An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
  EPSS 1.9%

All 97 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2023-50386 Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

  Apache Software Foundation · Apache Solr

  EPSS 84%
• High 8.8
  CVE-2023-6933 Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

  WP Engine · Better Search Replace

  EPSS 68%
• Medium 4.3
  CVE-2024-22241 Aria Operations for Networks contains a cross site scripting vulnerability. A malicious actor with admin privileges can inject a malicious payload into the log…
  EPSS 38%
• High 8.8
  CVE-2024-24824 graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

  Graylog2 · graylog2-server

  EPSS 35%
• High 7.5
  CVE-2024-20290 A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an aff…

  Cisco · Cisco Secure Endpoint · Cisco Secure Endpoint Private Cloud Console · Cisco Secure Endpoint Private Cloud Administration Portal

  EPSS 33%
• Medium 5.3
  CVE-2024-24942 In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

  JetBrains · TeamCity

  EPSS 32%
• Medium 6.1
  CVE-2024-24494 Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pray, read_book, vita…
  EPSS 26%
• High 8.8
  CVE-2024-1283 Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.…

  Google · Chrome

  EPSS 22%