Week 14, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-3272 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials

  D-Link · DNS-340L · DNS-327L · DNS-325

  EPSS 98%
• Critical 10.0
  CVE-2024-2389 Flowmon Unauthenticated Command Injection Vulnerability

  Progress Software · Flowmon

  EPSS 93%
• Critical 9.8
  CVE-2024-30568 Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter.
  EPSS 47%
• Critical 9.8
  CVE-2023-51573 Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability

  Voltronic Power · ViewPower Pro

  EPSS 46%
• Critical 9.8
  CVE-2023-51572 Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability

  Voltronic Power · ViewPower Pro

  EPSS 38%
• Critical 9.8
  CVE-2024-29276 An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.cla…
  EPSS 33%
• Critical 9.8
  CVE-2024-24724 Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is pa…
  EPSS 26%
• Critical 9.8
  CVE-2024-2879 The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escapi…

  LayerSlider · LayerSlider

  EPSS 18%
• Critical 9.8
  CVE-2024-31848 A path traversal vulnerability exists in the Java version of CData API Server < 23.4.8844 when running using the embedded Jetty server, which could allow an un…

  CData · API Server

  EPSS 8.1%
• Critical 9.8
  CVE-2024-31849 A path traversal vulnerability exists in the Java version of CData Connect < 23.4.8846 when running using the embedded Jetty server, which could allow an unaut…

  CData · Connect

  EPSS 6.1%
• Critical 9.9
  CVE-2024-27972 WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerability

  Jack Arturo · WP Fusion Lite

  EPSS 1.6%
• Critical 9.8
  CVE-2024-28515 Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-upd…
  EPSS 1.5%
• Critical 9.8
  CVE-2024-29375 CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to the Project Descript…
  EPSS 1.5%
• Critical 9.8
  CVE-2024-31002 Buffer Overflow vulnerability in Bento4 Bento v.1.6.0-641 allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache() at Ap4Utils.cpp…
  EPSS 1.4%
• Critical 9.8
  CVE-2024-27981 A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a mal…

  Ubiquiti · UniFi Network Application

  EPSS 1.3%

All 61 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.3
  CVE-2024-3273 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection

  D-Link · DNS-340L · DNS-325 · DNS-327L

  EPSS 100%
• High 7.5
  CVE-2023-45288 HTTP/2 CONTINUATION flood in net/http

  Go standard library · golang.org/x/net · net/http · golang.org/x/net/http2

  EPSS 89%
• High 7.5
  CVE-2024-27316 Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

  Apache Software Foundation · Apache HTTP Server

  EPSS 89%
• Medium 5.3
  CVE-2024-30255 HTTP/2: CPU exhaustion due to CONTINUATION frame flood

  envoyproxy · envoy

  EPSS 85%
• High 7.5
  CVE-2024-27919 HTTP/2: memory exhaustion due to CONTINUATION frame flood

  envoyproxy · envoy

  EPSS 84%
• Medium 5.3
  CVE-2024-28182 Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage

  nghttp2 · nghttp2

  EPSS 82%
• High 8.2
  CVE-2024-2653 CVE-2024-2653

  AMPHP · amphp/http · amphp/http-client

  EPSS 80%
• High 8.8
  CVE-2024-28741 Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.
  EPSS 78%