Week 35, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-6670 WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 93%
• Critical 9.8
  CVE-2024-45488 One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. This only affects virtual appli…
  EPSS 51%
• Critical 9.8
  CVE-2024-8181 Flowise Authentication Bypass

  FlowiseAI · Flowise

  EPSS 45%
• Critical 9.3
  CVE-2024-43917 WordPress TI WooCommerce Wishlist plugin <= 2.8.2 - SQL Injection vulnerability

  templateinvaders · TI WooCommerce Wishlist

  EPSS 23%
• Critical 9.8
  CVE-2024-6671 WhatsUp Gold GetStatisticalMonitorList SQL Injection Authentication Bypass Vulnerability

  Progress Software · WhatsUp Gold

  EPSS 19%
• Critical 9.8
  CVE-2024-42905 Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administra…
  EPSS 15%
• Critical 9.8
  CVE-2024-45256 An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite databases and bypass authen…
  EPSS 5.6%
• Critical 9.1
  CVE-2024-3673 Web Directory Free < 1.7.3 - Unauthenticated LFI
  EPSS 5.6%
• Critical 9.3
  CVE-2024-7988 ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities

  Rockwell Automation · ThinManager® ThinServer™

  EPSS 4.8%
• Critical 9.3
  CVE-2024-5057 WordPress Easy Digital Downloads plugin <= 3.2.12 - SQL Injection vulnerability

  Easy Digital Downloads · Easy Digital Downloads

  EPSS 2.6%
• Critical 9.1
  CVE-2024-45436 Ollama can extract members of a ZIP archive outside of the parent directory
  EPSS 2.6%
• Critical 9.3
  CVE-2024-43144 WordPress Cost Calculator Builder plugin <= 3.2.15 - SQL Injection vulnerability

  StylemixThemes · Cost Calculator Builder

  EPSS 2%
• Critical 9.8
  CVE-2024-45490 An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XML_ParseBuffer.
  EPSS 1.7%
• Critical 9.8
  CVE-2024-8162 TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials

  Toto Link · T10 AC1200

  EPSS 1.7%
• Critical 10.0
  CVE-2024-43918 WordPress WBW Product Table PRO plugin <= 1.9.4 - Unauthenticated Arbitrary SQL Query Execution vulnerability

  WBW · WBW Product Table PRO

  EPSS 1.5%

All 61 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Medium 6.5
  CVE-2023-26315 Xiaomi router has a command injection vulnerability after authorization

  Xiaomi · Router AX9000

  EPSS 19%
• High 8.1
  CVE-2024-7856 MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.7.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion

  sonaar · MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar

  EPSS 19%
• High 7.5
  CVE-2024-8182 Flowise Denial of Service

  FlowiseAI · Flowise

  EPSS 14%
• High 7.5
  CVE-2024-45241 A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated attackers to read fil…
  EPSS 14%
• Medium 5.3
  CVE-2024-45440 Drupal Full Path Disclosure

  Drupal · Drupal core

  EPSS 9.3%
• Medium 6.3
  CVE-2024-8212 D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_2nd_DiskMGR command injection

  D-Link · DNS-320 · DNS-340L · DNS-325

  EPSS 7.5%
• Medium 6.3
  CVE-2024-8210 D-Link DNS-1550-04 hd_config.cgi sprintf command injection

  D-Link · DNS-320 · DNS-340L · DNS-325

  EPSS 7.5%
• Medium 6.3
  CVE-2024-8213 D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_1st_DiskMGR command injection

  D-Link · DNS-320 · DNS-340L · DNS-325

  EPSS 7.2%