Week 26, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-4885 WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 99%
• Critical 9.8
  CVE-2024-5276 SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

  Fortra · FileCatalyst Workflow

  EPSS 90%
• Critical 9.1
  CVE-2024-5806 MOVEit Transfer Authentication Bypass Vulnerability

  Progress Software · MOVEit Transfer

  EPSS 81%
• Critical 9.8
  CVE-2024-4883 WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 65%
• Critical 9.8
  CVE-2024-4884 WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 24%
• Critical 9.8
  CVE-2024-6028 Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

  Ays Pro · Quiz Maker

  EPSS 12%
• Critical 9.8
  CVE-2024-6127 BC Security Empire Path Traversal RCE

  BC-SECURITY · Empire

  EPSS 10%
• Critical 9.6
  CVE-2024-5655 Improper Access Control in GitLab

  GitLab · GitLab

  EPSS 7.5%
• Critical 9.1
  CVE-2024-5805 MOVEit Gateway Authentication Bypass Vulnerability

  Progress Software · MOVEit Gateway

  EPSS 6.8%
• Critical 9.1
  CVE-2024-5535 SSL_select_next_proto buffer overread

  OpenSSL · OpenSSL

  EPSS 6.1%
• Critical 9.1
  CVE-2024-29868 Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

  Apache Software Foundation · Apache StreamPipes

  EPSS 6%
• Critical 9.8
  CVE-2024-5827 Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna

  vanna-ai · vanna-ai/vanna

  EPSS 3.4%
• Critical 9.8
  CVE-2024-37759 DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing interface.
  EPSS 2.8%
• Critical 9.8
  CVE-2024-5181 Command Injection in mudler/localai

  mudler · mudler/localai

  EPSS 2.7%
• Critical 9.3
  CVE-2024-5988 Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability

  Rockwell Automation · ThinManager® ThinServer™

  EPSS 2.7%

All 77 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2024-5010 WhatsUp Gold TestController multiple information disclosure vulnerabilities

  Progress Software · WhatsUp Gold

  EPSS 70%
• Medium 6.1
  CVE-2024-27136 Apache JSPWiki: Cross-site scripting vulnerability on upload page

  Apache Software Foundation · Apache JSPWiki

  EPSS 61%
• High 7.5
  CVE-2024-37843 Craft CMS SQL injection vulnerability via the GraphQL API endpoint
  EPSS 53%
• High 7.5
  CVE-2024-5011 WhatsUp Gold TestController Chart denial of service vulnerability

  Progress Software · WhatsUp Gold

  EPSS 47%
• High 8.7
  CVE-2024-4901 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

  GitLab · GitLab

  EPSS 33%
• Medium 4.3
  CVE-2024-5936 Open Redirect in imartinez/privategpt

  imartinez · imartinez/privategpt

  EPSS 30%
• Medium 6.8
  CVE-2024-37085 VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an ESX…
  EPSS 27%
• High 7.2
  CVE-2024-5016 WhatsUp Gold OnMessage Deserialization of Untrusted Data Remote Code Execution Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 22%