Week 18, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-40504 LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability

  LG · Simple Editor

  EPSS 89%
• Critical 9.8
  CVE-2023-40498 LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability

  LG · Simple Editor

  EPSS 85%
• Critical 9.8
  CVE-2023-38096 NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability

  NETGEAR · ProSAFE Network Management System

  EPSS 82%
• Critical 9.8
  CVE-2024-2876 Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

  Icegram · Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress

  EPSS 81%
• Critical 9.8
  CVE-2023-32165 D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability

  D-Link · D-View

  EPSS 73%
• Critical 9.8
  CVE-2023-40497 LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability

  LG · Simple Editor

  EPSS 67%
• Critical 9.8
  CVE-2023-39475 Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Inductive Automation · Ignition

  EPSS 64%
• Critical 9.8
  CVE-2023-49606 A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. A specially crafted HTTP header can trig…

  Tinyproxy Project · tinyproxy

  EPSS 63%
• Critical 9.8
  CVE-2023-32169 D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability

  D-Link · D-View

  EPSS 56%
• Critical 9.8
  CVE-2024-34144 Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

  Jenkins Project · Jenkins Script Security Plugin

  EPSS 48%
• Critical 9.8
  CVE-2023-51595 Voltronic Power ViewPower Pro selectDeviceListBy SQL Injection Remote Code Execution Vulnerability

  Voltronic Power · ViewPower Pro

  EPSS 48%
• Critical 9.8
  CVE-2024-26304 There is a buffer overflow vulnerability in the underlying L2/L3 Management service that could lead to unauthenticated remote code execution by sending special…

  Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

  EPSS 44%
• Critical 9.4
  CVE-2024-1874 Command injection via array-ish $command parameter of proc_open()

  PHP Group · PHP

  EPSS 33%
• Critical 9.8
  CVE-2024-26305 There is a buffer overflow vulnerability in the underlying Utility daemon that could lead to unauthenticated remote code execution by sending specially crafted…

  Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

  EPSS 15%
• Critical 9.8
  CVE-2024-33512 There is a buffer overflow vulnerability in the underlying Local User Authentication Database service that could lead to unauthenticated remote code execution …

  Hewlett Packard Enterprise (HPE) · Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central

  EPSS 15%

All 105 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.8
  CVE-2023-44443 GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability

  GIMP · GIMP

  EPSS 94%
• High 7.5
  CVE-2023-32164 D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability

  D-Link · D-View

  EPSS 85%
• High 8.2
  CVE-2023-44412 D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability

  D-Link · D-View

  EPSS 82%
• High 8.2
  CVE-2023-40494 LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability

  LG · Simple Editor

  EPSS 82%
• High 8.2
  CVE-2023-40492 LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability

  LG · Simple Editor

  EPSS 82%
• High 8.2
  CVE-2023-40502 LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability

  LG · Simple Editor

  EPSS 82%
• High 7.5
  CVE-2023-40495 LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability

  LG · Simple Editor

  EPSS 76%
• Medium 6.5
  CVE-2023-32167 D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability

  D-Link · D-View

  EPSS 75%