Week 32, 2024

5–11 August 2024

New CVEs: 597
Critical: 81
High: 231
Newly exploited: 3
Advisories: 181
Malicious pkgs: 192

Newly exploited 3

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.1
CVE-2024-32113 KEV Aug 7, 2024 Apache OFBiz: Path traversal leading to RCE
Apache Software Foundation · Apache OFBiz

EPSS 100%
High 7.8
CVE-2024-36971 KEV Aug 7, 2024 net: fix __dst_negative_advice() race
Linux · Linux

EPSS 2.7%
High 7.5
CVE-2018-0824 KEV Aug 5, 2024 A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows…
EPSS 73%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2024-6782 Calibre Remote Code Execution
Calibre · Calibre

EPSS 84%
Critical 9.3
CVE-2024-42009 A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a cra…
EPSS 83%
Critical 9.3
CVE-2024-42008 A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and …
EPSS 34%
Critical 10.0
CVE-2024-6886 Inproper Sanitation of field leading to stored XSS
Gitea · Gitea Open Source Git Server

EPSS 33%
Critical 9.6
CVE-2024-28739 An issue in Koha ILS 23.05 and before allows a remote attacker to execute arbitrary code via a crafted script to the format parameter.
EPSS 19%
Critical 9.8
CVE-2024-39225 GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E75…
EPSS 14%
Critical 9.8
CVE-2024-20450 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones…
Cisco · Cisco Small Business IP Phones

EPSS 7.2%
Critical 9.8
CVE-2024-20454 Multiple vulnerabilities in the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones…
Cisco · Cisco Small Business IP Phones

EPSS 6.6%
Critical 9.8
CVE-2024-41570 An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic originating …
EPSS 2.9%
Critical 9.8
CVE-2024-36130 An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary …
ivanti · EPMM

EPSS 2.3%
Critical 10.0
CVE-2024-3659 Command injection in KAON AR2140 routers
Kaon · AR2140

EPSS 1.6%
Critical 9.9
CVE-2024-22116 Remote code execution within ping script
Zabbix · Zabbix

EPSS 1.6%
Critical 9.8
CVE-2024-42005 Django SQL injection vulnerability
EPSS 1.5%
Critical 9.2
CVE-2024-21878 Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x
Enphase · Envoy

EPSS 1.4%
Critical 9.3
CVE-2024-7397 Unauthenticated Command Injection
Korenix · JetPort 5601v3

EPSS 1.4%

All 81 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.1
CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code
Apache Software Foundation · Apache OFBiz

EPSS 99%
High 8.8
CVE-2024-7399 Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitr…
Samsung Electronics · MagicINFO 9 Server

EPSS 92%
High 7.5
CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messag…
EPSS 67%
High 7.5
CVE-2024-6781 Calibre Arbitrary File Read
Calibre · Calibre

EPSS 62%
High 7.5
CVE-2024-6893 Journyx Unauthenticated XML External Entities Injection
Journyx · Journyx (jtime)

EPSS 33%
High 8.8
CVE-2024-43044 Jenkins Remoting library arbitrary file read vulnerability
Jenkins Project · Jenkins

EPSS 29%
Medium 5.4
CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)
Calibre · Calibre

EPSS 26%
Medium 6.3
CVE-2024-7469 Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injection
Raisecom · MSG1200 · MSG2200 · MSG2100E

EPSS 25%

Advisories

USN-6952-1 linux-nvidia-lowlatency, linux-oracle vulnerabilities 233 CVEs
USN-6949-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-nvidia, linux-nvidia-6.8 vulnerabilities 226 CVEs
SUSE-SU-2024:2802-1 Security update for the Linux Kernel 118 CVEs
USN-6953-1 linux-oracle, linux-oracle-5.4 vulnerabilities 90 CVEs
USN-6951-1 linux, linux-aws, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabilities 83 CVEs
USN-6950-1 linux, linux-aws, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia vulnerabilities 50 CVEs
openSUSE-SU-2024:14244-1 ansible-9-9.8.0-1.1 on GA media 45 CVEs
SUSE-SU-2024:2850-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5) 15 CVEs
SUSE-SU-2024:2824-1 Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP4) 15 CVEs
SUSE-SU-2024:2755-1 Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP3) 13 CVEs