Week 34, 2024

19–25 August 2024

New CVEs: 655
Critical: 78
High: 243
Newly exploited: 6
Advisories: 172
Malicious pkgs: 60

Newly exploited 6

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Medium 6.6
CVE-2024-39717 KEV Aug 23, 2024 The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-D…
Versa · Director

EPSS 4%
Critical 9.8
CVE-2021-33045 KEV Aug 21, 2024 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by …
EPSS 100%
Critical 9.8
CVE-2021-33044 KEV Aug 21, 2024 The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by …
EPSS 100%
High 8.4
CVE-2022-0185 KEV Aug 21, 2024 A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the…
EPSS 25%
High 7.2
CVE-2021-31196 KEV Aug 21, 2024 Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23 · Microsoft Exchange Server 2016 Cumulative Update 21 · Microsoft Exchange Server 2019 Cumulative Update 10

EPSS 54%
Critical 9.8
CVE-2024-23897 KEV Aug 19, 2024 · ransomware Arbitrary file read vulnerability through the Jenkins CLI can lead to RCE
Jenkins Project · Jenkins

EPSS 100%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.1
CVE-2024-28987 SolarWinds Web Help Desk Hardcoded Credential Vulnerability
SolarWinds · Web Help Desk

EPSS 93%
Critical 9.8
CVE-2024-7954 SPIP porte_plume Plugin Arbitrary PHP Execution
SPIP · SPIP

EPSS 90%
Critical 10.0
CVE-2024-5932 GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
stellarwp · GiveWP – Donation Plugin and Fundraising Platform

EPSS 77%
Critical 9.8
CVE-2024-28000 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
LiteSpeed Technologies · LiteSpeed Cache

EPSS 68%
Critical 9.9
CVE-2024-6386 WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
WPML · WPML

EPSS 26%
Critical 9.8
CVE-2024-32501 A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before 23.…
EPSS 19%
Critical 9.3
CVE-2024-40766 An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an…
SonicWall · SonicOS

EPSS 18%
Critical 9.8
CVE-2024-42812 In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who successf…
EPSS 16%
Critical 10.0
CVE-2024-7854 Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
sjhoo · Woo Inquiry

EPSS 4.3%
Critical 9.8
CVE-2024-43202 Apache DolphinScheduler: Remote Code Execution Vulnerability
Apache Software Foundation · Apache DolphinScheduler

EPSS 2.1%
Critical 9.8
CVE-2024-6330 GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI
EPSS 2.1%
Critical 9.5
CVE-2024-6800 An XML signature wrapping vulnerability was present in GitHub Enterprise Server (GHES) when using SAML authentication with specific identity providers utilizin…
GitHub · GitHub Enterprise Server

EPSS 1.5%
Critical 9.8
CVE-2024-45169 An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction…
EPSS 1.4%
Critical 9.8
CVE-2024-45167 An issue was discovered in UCI IDOL 2 (aka uciIDOL or IDOL2) through 2.12. Due to improper input validation, improper deserialization, and improper restriction…
EPSS 1.2%
Critical 9.8
CVE-2024-40453 squirrelly Code Injection vulnerability
EPSS 1.1%

All 78 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.1
CVE-2024-5762 Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability
Zen Cart · Zen Cart

EPSS 72%
High 8.8
CVE-2024-5725 Centreon initCurveList SQL Injection Remote Code Execution Vulnerability
Centreon · Centreon

EPSS 47%
High 8.8
CVE-2024-5723 Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability
Centreon · Centreon

EPSS 41%
Medium 6.3
CVE-2024-8132 D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection
D-Link · DNS-320 · DNS-340L · DNS-325

EPSS 24%
Medium 6.3
CVE-2024-8129 D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection
D-Link · DNS-320 · DNS-340L · DNS-325

EPSS 24%
High 8.8
CVE-2024-7971 Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security s…
Google · Chrome

EPSS 21%
Medium 6.3
CVE-2024-7922 D-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injection
D-Link · DNS-320 · DNS-340L · DNS-325

EPSS 20%
High 8.8
CVE-2024-7965 Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML …
Google · Chrome

EPSS 19%

Advisories

SUSE-SU-2024:2973-1 Security update for the Linux Kernel 783 CVEs
USN-6979-1 linux-raspi-5.4 vulnerabilities 90 CVEs
USN-6951-4 linux-bluefield vulnerabilities 83 CVEs
USN-6951-3 linux-azure-5.4 vulnerabilities 83 CVEs
USN-6950-4 linux-hwe-5.15 vulnerabilities 49 CVEs
SUSE-SU-2024:3003-1 Security update for MozillaFirefox 28 CVEs
USN-6966-1 firefox vulnerabilities 13 CVEs
USN-6969-1 cacti vulnerabilities 9 CVEs
LSN-0106-1 Kernel Live Patch Security Notice 3 CVEs
SUSE-SU-2024:2953-1 Security update for openssl-1_1 2 CVEs