Week 33, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-7593 Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass a…

  ivanti · vTM

  EPSS 100%
• Critical 9.8
  CVE-2024-28986 SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability

  SolarWinds · Web Help Desk

  EPSS 85%
• Critical 9.8
  CVE-2024-41730 Missing Authentication check in SAP BusinessObjects Business Intelligence Platform

  SAP · SAP BusinessObjects Business Intelligence Platform

  EPSS 76%
• Critical 9.8
  CVE-2024-38063 Windows TCP/IP Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 74%
• Critical 9.8
  CVE-2024-7094 JS Help Desk – The Ultimate Help Desk & Support Plugin <= 2.8.6 - Unauthenticated PHP Code Injection to Remote Code Execution

  rabilal · JS Help Desk – AI-Powered Support & Ticketing System

  EPSS 38%
• Critical 9.8
  CVE-2024-43360 ZoneMinder Time-based SQL Injection

  ZoneMinder · zoneminder

  EPSS 6.2%
• Critical 9.8
  CVE-2024-6460 Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI
  EPSS 4.8%
• Critical 10.0
  CVE-2024-43160 WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability

  BerqWP · BerqWP

  EPSS 4.6%
• Critical 9.8
  CVE-2024-38140 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 3.8%
• Critical 9.3
  CVE-2024-7262 Arbitrary Code Execution in WPS Office

  Kingsoft · WPS Office

  EPSS 3.1%
• Critical 10.0
  CVE-2024-42479 llama.cpp allows write-what-where in rpc_server::set_tensor

  ggerganov · llama.cpp

  EPSS 2.6%
• Critical 9.8
  CVE-2024-38199 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 2.2%
• Critical 9.8
  CVE-2024-42634 A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with r…
  EPSS 2.2%
• Critical 9.1
  CVE-2024-38160 Windows Network Virtualization Remote Code Execution Vulnerability

  Microsoft · Windows Server 2016 · Windows Server 2016 (Server Core installation) · Windows 10 Version 1607

  EPSS 2.2%
• Critical 9.1
  CVE-2024-38159 Windows Network Virtualization Remote Code Execution Vulnerability

  Microsoft · Windows Server 2016 · Windows Server 2016 (Server Core installation) · Windows 10 Version 1607

  EPSS 2.2%

All 69 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.2
  CVE-2024-38653 XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.

  ivanti · Avalanche

  EPSS 92%
• Medium 6.8
  CVE-2024-41710 A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a…
  EPSS 42%
• High 7.5
  CVE-2024-38178 Scripting Engine Memory Corruption Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 41%
• High 8.8
  CVE-2024-38144 Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 32%
• High 7.5
  CVE-2024-38148 Windows Secure Channel Denial of Service Vulnerability

  Microsoft · Windows Server 2022 · Windows 11 Version 24H2 · Windows 11 version 23H2

  EPSS 32%
• High 7.8
  CVE-2024-38193 Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 29%
• High 7.5
  CVE-2024-37399 A NULL pointer dereference in WLAvalancheService in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to crash the service, resulting in a DoS.

  ivanti · Avalanche

  EPSS 28%
• High 8.8
  CVE-2024-7646 CVE-2024-7646 in github.com/kubernetes/ingress-nginx

  Kubernetes · ingress-nginx

  EPSS 27%