Week 36, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-45195 Apache OFBiz: Confused controller-view authorization logic (forced browsing)

  Apache Software Foundation · Apache OFBiz

  EPSS 100%
• Critical 9.8
  CVE-2024-20439 A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static admini…

  Cisco · Cisco Smart License Utility

  EPSS 97%
• Critical 9.8
  CVE-2024-8517 SPIP Bigup Multipart File Upload OS Command Injection

  SPIP · SPIP

  EPSS 95%
• Critical 9.8
  CVE-2024-40711 A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).

  Veeam · Backup and Recovery

  EPSS 90%
• Critical 10.0
  CVE-2024-7591 Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

  Progress Software · LoadMaster

  EPSS 39%
• Critical 9.8
  CVE-2024-45622 ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.
  EPSS 36%
• Critical 9.8
  CVE-2024-7261 The improper neutralization of special elements in the parameter "host" in the CGI program of Zyxel NWA1123ACv3 firmware version 6.70(ABVT.4) and earlier, WAC5…

  Zyxel · WAC500 firmware · WBE530 firmware · USG LITE 60AX firmware

  EPSS 11%
• Critical 9.3
  CVE-2024-24759 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding

  MindsDB · MindsDB

  EPSS 4.9%
• Critical 9.8
  CVE-2024-8381 A potentially exploitable type confusion could be triggered when looking up a property name on an object being used as the `with` environment. This vulnerabili…

  Mozilla · Firefox · Thunderbird · Firefox ESR

  EPSS 4.4%
• Critical 9.8
  CVE-2024-6924 TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi
  EPSS 3.3%
• Critical 9.8
  CVE-2024-6928 Opti Marketing <= 2.0.9 - Unauthenticated SQLi
  EPSS 3.3%
• Critical 9.8
  CVE-2024-6926 Viral Signup <= 2.1 - Unauthenticated SQLi
  EPSS 3.3%
• Critical 9.8
  CVE-2024-44402 D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.
  EPSS 3.1%
• Critical 9.8
  CVE-2024-44401 D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file
  EPSS 2.9%
• Critical 9.1
  CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

  ethyca · fides

  EPSS 1.3%

All 69 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.8
  CVE-2024-45507 Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE

  Apache Software Foundation · Apache OFBiz

  EPSS 96%
• High 7.5
  CVE-2024-6119 Possible denial of service in X.509 name checks

  OpenSSL · OpenSSL

  EPSS 67%
• High 7.5
  CVE-2024-45388 Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)

  SpectoLabs · hoverfly

  EPSS 56%
• High 7.5
  CVE-2024-20440 A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to …

  Cisco · Cisco Smart License Utility

  EPSS 52%
• High 8.0
  CVE-2024-44400 A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upgrade_filter_asp function in the upgrade_…
  EPSS 14%
• High 7.3
  CVE-2024-42471 Arbitrary File Write via artifact extraction in actions/artifact

  actions · toolkit

  EPSS 3.2%
• Medium 6.3
  CVE-2024-8574 TOTOLINK AC1200 T8 cstecgi.cgi setParentalRules os command injection

  Toto Link · AC1200 T8

  EPSS 3.1%
• High 8.1
  CVE-2024-7627 Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition

  bitpressadmin · Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress

  EPSS 2.8%