Week 13, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 10.0
  CVE-2024-3094 Xz: malicious code in distributed source

  Red Hat · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 7

  EPSS 91%
• Critical 9.1
  CVE-2024-2862 Password reset vulnerability without authorization on LG LED Assistant

  LG Electronics · LG LED Assistant

  EPSS 51%
• Critical 9.1
  CVE-2024-25735 An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET reque…
  EPSS 51%
• Critical 9.8
  CVE-2023-49231 An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token.
  EPSS 43%
• Critical 9.6
  CVE-2023-41724 A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operatin…

  ivanti · Sentry

  EPSS 13%
• Critical 10.0
  CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery

  jumpserver · jumpserver

  EPSS 6%
• Critical 10.0
  CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

  jumpserver · jumpserver

  EPSS 5.9%
• Critical 9.9
  CVE-2023-48777 WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability

  Elementor.com · Elementor Website Builder

  EPSS 4.1%
• Critical 9.8
  CVE-2024-28545 Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function.
  EPSS 2.3%
• Critical 9.1
  CVE-2023-47873 WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerability

  WEN Solutions · WP Child Theme Generator

  EPSS 2.3%
• Critical 9.3
  CVE-2024-30502 WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

  WP Travel Engine · WP Travel Engine

  EPSS 2.2%
• Critical 9.3
  CVE-2024-30498 WordPress CRM Perks Forms plugin <= 1.1.4 - Unauthenticated SQL Injection vulnerability

  CRM Perks · CRM Perks Forms

  EPSS 2.2%
• Critical 9.3
  CVE-2024-30490 WordPress ProfileGrid plugin <= 5.7.8 - SQL Injection vulnerability

  Metagauss · ProfileGrid

  EPSS 2.2%
• Critical 10.0
  CVE-2024-30247 Command Injection as root in NextCloudPi web panel

  Nextcloud · nextcloudpi

  EPSS 2.1%
• Critical 9.9
  CVE-2023-46808 An file upload vulnerability in Ivanti ITSM before 2023.4, allows an authenticated remote user to perform file writes to the server. Successful exploitation ma…

  ivanti · ITSM

  EPSS 2%

All 96 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 4.6
  CVE-2024-31138 In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings

  JetBrains · TeamCity

  EPSS 75%
• Medium 5.3
  CVE-2024-2863 Path traversal via file upload on LG LED Assistant

  LG Electronics · LG LED Assistant

  EPSS 64%
• High 8.6
  CVE-2024-2398 HTTP/2 push headers memory-leak

  curl · curl

  EPSS 36%
• High 8.5
  CVE-2024-30491 WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability

  Metagauss · ProfileGrid

  EPSS 32%
• Medium 6.3
  CVE-2024-3013 Teledyne FLIR AX8 User Registration test_login.php improper authorization

  Teledyne FLIR · AX8

  EPSS 23%
• High 7.2
  CVE-2023-40289 A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a…
  EPSS 18%
• High 8.1
  CVE-2024-2887 Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se…

  Google · Chrome

  EPSS 18%
• Medium 5.5
  CVE-2024-2982 Tenda FH1202 WriteFacMac formWriteFacMac command injection

  Tenda · FH1202

  EPSS 8.2%