Week 12, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.9
  CVE-2024-27956 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

  ValvePress · Automatic

  EPSS 94%
• Critical 9.9
  CVE-2024-1800 Progress Telerik Report Server Deserialization

  Progress Software · Telerik Report Server

  EPSS 34%
• Critical 9.8
  CVE-2024-29943 An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affec…

  Mozilla · Firefox

  EPSS 23%
• Critical 10.0
  CVE-2024-24578 RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload

  jens-maus · RaspberryMatic

  EPSS 8.7%
• Critical 9.8
  CVE-2024-29275 SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the …
  EPSS 5%
• Critical 9.8
  CVE-2024-29864 Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
  EPSS 2.9%
• Critical 9.1
  CVE-2024-2443 Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console

  GitHub · GitHub Enterprise Server

  EPSS 2.1%
• Critical 9.8
  CVE-2024-29937 NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug tha…
  EPSS 1.8%
• Critical 9.1
  CVE-2024-29185 FreeScout OS Command Injection vulnerability

  freescout-help-desk · freescout

  EPSS 1.7%
• Critical 9.0
  CVE-2024-29385 DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.
  EPSS 1.6%
• Critical 9.8
  CVE-2024-28861 Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder

  FriendsOfSymfony1 · symfony1

  EPSS 1.5%
• Critical 9.8
  CVE-2023-48902 An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicle…
  EPSS 1.3%
• Critical 9.8
  CVE-2024-28441 File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of …
  EPSS 1.2%
• Critical 9.8
  CVE-2024-28595 SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in update-admin.php.
  EPSS 1.2%
• Critical 9.1
  CVE-2024-29027 Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

  parse-community · parse-server

  EPSS 1.2%

All 68 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2024-29059 .NET Framework Information Disclosure Vulnerability

  Microsoft · Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.8 · Microsoft .NET Framework 3.5 AND 4.7.2

  EPSS 99%
• High 7.4
  CVE-2024-20767 ColdFusion | Improper Access Control (CWE-284)

  Adobe · ColdFusion

  EPSS 99%
• High 8.8
  CVE-2024-27921 Grav File Upload Path Traversal vulnerability

  getgrav · grav

  EPSS 61%
• High 7.7
  CVE-2024-27096 SQL Injection in through the search engine

  GLPI · glpi

  EPSS 59%
• High 8.4
  CVE-2024-2448 LoadMaster Command Injection Vulnerability

  Progress Software · LoadMaster

  EPSS 55%
• High 8.8
  CVE-2024-24725 Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin…
  EPSS 52%
• Medium 6.4
  CVE-2024-27098 Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI

  GLPI · glpi

  EPSS 36%
• Medium 6.5
  CVE-2024-27937 glpi Users emails enumeration

  GLPI · glpi

  EPSS 27%