Week 15, 2024

8–14 April 2024

New CVEs: 963
Critical: 67
High: 343
Newly exploited: 3
Advisories: 390
Malicious pkgs: 50

Newly exploited 3

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2024-3400 KEV Apr 12, 2024 · ransomware PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

EPSS 100%
Critical 9.8
CVE-2024-3272 KEV Apr 11, 2024 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
D-Link · DNS-340L · DNS-325 · DNS-327L

EPSS 98%
High 7.3
CVE-2024-3273 KEV Apr 11, 2024 D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
D-Link · DNS-340L · DNS-327L · DNS-325

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Palo Alto Networks · PAN-OS · Prisma Access · Cloud NGFW

EPSS 100%
Critical 10.0
CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet
xwiki · xwiki-platform

EPSS 83%
Critical 10.0
CVE-2024-31465 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
xwiki · xwiki-platform

EPSS 76%
Critical 10.0
CVE-2024-31997 XWiki Platform remote code execution from account through UIExtension parameters
xwiki · xwiki-platform

EPSS 74%
Critical 10.0
CVE-2023-51409 WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
Jordy Meow · AI Engine: ChatGPT Chatbot

EPSS 63%
Critical 9.8
CVE-2024-1520 OS Command Injection in parisneo/lollms-webui
parisneo · parisneo/lollms-webui

EPSS 48%
Critical 10.0
CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch
xwiki · xwiki-platform

EPSS 35%
Critical 9.3
CVE-2024-1600 Local File Inclusion in parisneo/lollms-webui
parisneo · parisneo/lollms-webui

EPSS 33%
Critical 10.0
CVE-2024-24576 Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
rust-lang · rust

EPSS 20%
Critical 9.0
CVE-2024-29990 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Microsoft · Azure Kubernetes Service

EPSS 18%
Critical 9.7
CVE-2024-31214 Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution
traccar · traccar

EPSS 18%
Critical 9.8
CVE-2024-31819 WWBN AVideo Remote Code Execution
EPSS 16%
Critical 9.8
CVE-2024-3566 Command injection vulnerability in programing languages on Microsoft Windows operating system.
Node.js · Haskell Programming Language · Go Programming Language · Node.js

EPSS 6.8%
Critical 9.1
CVE-2023-6319 Command injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager service
LG · webOS

EPSS 6.4%
Critical 9.8
CVE-2024-3136 MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template
stylemix · MasterStudy LMS WordPress Plugin – for Online Courses and Education

EPSS 5%

All 67 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2024-31309 Apache Traffic Server: HTTP/2 CONTINUATION frames can be utilized for DoS attack
Apache Software Foundation · Apache Traffic Server

EPSS 92%
High 7.8
CVE-2024-26256 Libarchive Remote Code Execution Vulnerability
Microsoft · Windows 11 version 23H2 · Windows 11 version 22H2 · Windows Server 2022, 23H2 Edition (Server Core installation)

EPSS 88%
Medium 6.3
CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection
TBK · DVR-4216 · DVR-4104

EPSS 86%
High 7.5
CVE-2024-1728 Local File Inclusion in gradio-app/gradio
gradio-app · gradio-app/gradio

EPSS 85%
High 8.2
CVE-2024-27983 An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is…
Node.js · node

EPSS 84%
High 7.5
CVE-2024-26212 DHCP Server Service Denial of Service Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

EPSS 63%
Medium 5.9
CVE-2024-2511 Unbounded memory growth with session handling in TLSv1.3
OpenSSL · OpenSSL

EPSS 59%
High 7.5
CVE-2024-31817 In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.
EPSS 55%

Advisories

SSA-265688 SSA-265688: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 TM MFP V1.1 455 CVEs
ICSA-24-102-01 Siemens SIMATIC S7-1500 TM MFP 455 CVEs
USN-6725-1 linux, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities 46 CVEs
SSA-455250 SSA-455250: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 Devices Before V11.1.2-h3 25 CVEs
ICSA-24-102-04 Siemens RUGGEDCOM APE1808 25 CVEs
DSA-5658-1 linux - security update 19 CVEs
ICSA-24-102-05 Siemens Scalance W1750D 3 CVEs
SSA-885980 SSA-885980: Multiple Vulnerabilities in Scalance W1750D 3 CVEs
openSUSE-SU-2024:0106-1 Security update for sngrep 2 CVEs
VDE-2024-009 Welotec: Two vulnerabilities in TK500v1 router series 2 CVEs