Week 24, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-34102 XXE can expose crypt key and other secrets granting full admin access

  Adobe · Adobe Commerce

  EPSS 100%
• Critical 9.8
  CVE-2024-3552 Web Directory Free < 1.7.0 - Unauthenticated SQL Injection
  EPSS 67%
• Critical 10.0
  CVE-2024-3922 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection

  wedevs · Dokan Pro

  EPSS 53%
• Critical 9.8
  CVE-2024-3080 ASUS Router - Improper Authentication

  ASUS · RT-AC86U · RT-AX88U · RT-AX58U

  EPSS 43%
• Critical 9.8
  CVE-2024-30080 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 43%
• Critical 9.8
  CVE-2024-27172 Remote Code Execution

  Toshiba Tec · Toshiba Tec e-Studio multi-function peripheral (MFP)

  EPSS 27%
• Critical 9.0
  CVE-2024-29855 Hard-coded JWT secret allows authentication bypass in Veeam Recovery Orchestrator

  Veeam · Recovery Orchestrator

  EPSS 22%
• Critical 9.1
  CVE-2024-37642 TRENDnet TEW-814DAP v1_(FW1.01B01) was discovered to contain a command injection vulnerability via the ipv4_ping, ipv6_ping parameter at /formSystemCheck .
  EPSS 11%
• Critical 10.0
  CVE-2024-36412 SuiteCRM unauthenticated SQL Injection

  salesagility · SuiteCRM

  EPSS 5.7%
• Critical 9.3
  CVE-2024-37051 GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ IDEA 2023.1.7, 2023.2.7, 2023.3.7, 202…

  JetBrains · IntelliJ IDEA · PyCharm · WebStorm

  EPSS 4.9%
• Critical 9.8
  CVE-2024-4898 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.38 - Missing Authorization to Unauthenticated API setup/Arbitrary Options Update/Administrative User …

  InstaWP · InstaWP Connect – 1-click WP Staging & Migration

  EPSS 4.2%
• Critical 9.8
  CVE-2024-31777 File Upload vulnerability in openeclass v.3.15 and before allows an attacker to execute arbitrary code via a crafted file to the certbadge.php endpoint.
  EPSS 3.8%
• Critical 9.8
  CVE-2024-37393 Multiple LDAP injections vulnerabilities exist in SecurEnvoy MFA before 9.4.514 due to improper validation of user-supplied input. An unauthenticated remote at…
  EPSS 3.3%
• Critical 9.8
  CVE-2024-27173 insecure upload

  Toshiba Tec · Toshiba Tec e-Studio multi-function peripheral (MFP)

  EPSS 3.2%
• Critical 9.9
  CVE-2024-3105 Woody code snippets – Insert Header Footer Code, AdSense Ads <= 2.5.0 -Authenticated (Contributor+) Remote Code Execution

  themeisle · Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts

  EPSS 2.8%

All 94 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.0
  CVE-2024-30088 Windows Kernel Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 68%
• High 8.8
  CVE-2024-37014 Langflow remote code execution vulnerability
  EPSS 64%
• High 7.8
  CVE-2024-35250 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 25%
• High 7.5
  CVE-2024-34112 ColdFusion CFDOCUMENT file retrieval / access control bypass

  Adobe · ColdFusion

  EPSS 24%
• Medium 6.1
  CVE-2024-27162 DOM-based XSS

  Toshiba Tec · Toshiba Tec e-Studio multi-function peripheral (MFP)

  EPSS 21%
• High 7.8
  CVE-2024-30085 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 14%
• High 7.8
  CVE-2024-30087 Win32k Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 9.5%
• High 7.8
  CVE-2024-30089 Microsoft Streaming Service Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 8.1%