Week 30, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2023-45249 Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acroni…

  Acronis · Acronis Cyber Infrastructure

  EPSS 54%
• Critical 9.8
  CVE-2024-38289 A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to…
  EPSS 41%
• Critical 9.8
  CVE-2024-37084 CVE-2024-37084: Remote code execution in Spring Cloud Data Flow

  Spring · Spring Cloud Data Flow

  EPSS 35%
• Critical 10.0
  CVE-2024-41110 Moby authz zero length regression

  moby · moby

  EPSS 16%
• Critical 9.6
  CVE-2024-26020 Ankitects Anki arbitrary script execution vulnerability

  ankitects · anki

  EPSS 15%
• Critical 9.1
  CVE-2024-40422 The snapshot_path parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipul…
  EPSS 11%
• Critical 9.8
  CVE-2024-39250 EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.
  EPSS 4.9%
• Critical 9.8
  CVE-2024-41468 Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand
  EPSS 4.6%
• Critical 9.8
  CVE-2024-41316 TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
  EPSS 2.5%
• Critical 9.8
  CVE-2024-41318 TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode functio…
  EPSS 2.4%
• Critical 9.1
  CVE-2024-42049 TightVNC (Server for Windows) before 2.8.84 allows attackers to connect to the control pipe via a network connection.
  EPSS 2.4%
• Critical 9.8
  CVE-2024-38944 An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateForm.cgi?formID=142 c…
  EPSS 2.4%
• Critical 9.9
  CVE-2024-6327 Progress Telerik Report Server Deserialization

  Progress Software · Telerik Report Server

  EPSS 2%
• Critical 9.3
  CVE-2024-38773 WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability

  Adrian Tobey · FormLift for Infusionsoft Web Forms

  EPSS 2%
• Critical 9.8
  CVE-2024-28698 CLSA Directory Traversal vulnerability
  EPSS 1.5%

All 53 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.3
  CVE-2024-7120 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection

  Raisecom · MSG2300 · MSG1200 · MSG2200

  EPSS 93%
• Medium 6.9
  CVE-2024-6922 Server-Side Request Forgery in Automation 360

  Automationanywhere · Automation 360

  EPSS 30%
• High 7.4
  CVE-2024-32484 An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to J…

  ankitects · anki

  EPSS 21%
• Medium 5.3
  CVE-2024-7156 TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure

  Toto Link · A3700R

  EPSS 13%
• Low 3.1
  CVE-2024-32152 Ankitects Anki LaTeX Blocklist Bypass vulnerability

  ankitects · anki

  EPSS 12%
• Medium 5.3
  CVE-2024-29073 Anki Latex Incomplete Blocklist Vulnerability

  ankitects · anki

  EPSS 12%
• Medium 6.3
  CVE-2024-36111 KubePi's JWT token validation has a defect

  1Panel-dev · KubePi

  EPSS 8.4%
• High 8.8
  CVE-2024-7157 TOTOLINK A3100R getSaveConfig buffer overflow

  Toto Link · A3100R

  EPSS 7.4%