Week 28, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-4879 Jelly Template Injection Vulnerability in ServiceNow UI Macros

  ServiceNow · Now Platform

  EPSS 100%
• Critical 9.8
  CVE-2024-5217 Incomplete Input Validation in GlideExpression Script

  ServiceNow · Now Platform

  EPSS 100%
• Critical 9.3
  CVE-2024-5910 Expedition: Missing Authentication Leads to Admin Account Takeover

  Palo Alto Networks · Expedition

  EPSS 92%
• Critical 9.8
  CVE-2024-38077 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 84%
• Critical 9.8
  CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

  aimhubio · aimhubio/aim

  EPSS 53%
• Critical 9.8
  CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=

  FOGProject · fogproject

  EPSS 23%
• Critical 9.4
  CVE-2024-6235 Sensitive information disclosure

  NetScaler · NetScaler Console

  EPSS 21%
• Critical 9.8
  CVE-2024-1305 tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory b…

  OpenVPN · OpenVPN-GUI · tap-windows6

  EPSS 15%
• Critical 9.0
  CVE-2024-3596 RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

  IETF · RFC

  EPSS 15%
• Critical 9.6
  CVE-2024-6385 Improper Access Control in GitLab

  GitLab · GitLab

  EPSS 7.2%
• Critical 9.8
  CVE-2024-5488 SEOPress < 7.9 - Unauthenticated Object Injection
  EPSS 3.7%
• Critical 9.1
  CVE-2024-5450 Bug Library < 2.1.1 - Unauthenticated RCE
  EPSS 3.3%
• Critical 9.8
  CVE-2024-6624 JSON API User <= 3.9.3 - Unauthenticated Privilege Escalation

  parorrey · JSON API User

  EPSS 2.9%
• Critical 9.8
  CVE-2024-38074 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 2.2%
• Critical 9.8
  CVE-2024-38076 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 2.1%

All 66 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2024-38112 Windows MSHTML Platform Spoofing Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 84%
• High 7.2
  CVE-2024-38023 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 53%
• Medium 6.5
  CVE-2024-38030 Windows Themes Spoofing Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 51%
• High 7.2
  CVE-2024-38094 Microsoft SharePoint Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 51%
• Medium 5.3
  CVE-2024-6646 Netgear WN604 Web Interface downloadFile.php information disclosure

  NETGEAR · WN604

  EPSS 46%
• High 7.2
  CVE-2024-38024 Microsoft SharePoint Server Remote Code Execution Vulnerability

  Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

  EPSS 45%
• High 7.5
  CVE-2024-38071 Windows Remote Desktop Licensing Service Denial of Service Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 36%
• Medium 4.9
  CVE-2024-5178 Incomplete Input Validation in SecurelyAccess API

  ServiceNow · Now Platform

  EPSS 34%