Week 37, 2024

9–15 September 2024

New CVEs: 721
Critical: 68
High: 283
Newly exploited: 7
Advisories: 8,130
Malicious pkgs: 28

Newly exploited 7

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

High 7.2
CVE-2024-8190 KEV Sep 13, 2024 An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain rem…
ivanti · CSA (Cloud Services Appliance)

EPSS 89%
High 7.8
CVE-2024-38014 KEV Sep 10, 2024 Windows Installer Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 6.3%
High 7.3
CVE-2024-38226 KEV Sep 10, 2024 Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft · Microsoft Office LTSC 2021 · Microsoft Office 2019 · Microsoft Publisher 2016

EPSS 2.7%
Medium 5.4
CVE-2024-38217 KEV Sep 10, 2024 Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 10%
Critical 9.3
CVE-2024-40766 KEV Sep 9, 2024 · ransomware An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access an…
SonicWall · SonicOS

EPSS 18%
High 8.4
CVE-2016-3714 KEV Sep 9, 2024 The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow rem…
EPSS 97%
High 7.8
CVE-2017-1000253 KEV Sep 9, 2024 · ransomware Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on Apri…
EPSS 11%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2024-8503 VICIdial Unauthenticated SQL Injection
VICIdial · VICIdial

EPSS 79%
Critical 10.0
CVE-2024-8522 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
ThimPress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

EPSS 63%
Critical 10.0
CVE-2024-29847 Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to a…
ivanti · EPM

EPSS 52%
Critical 9.8
CVE-2024-44849 Qualitor up to 8.24 is vulnerable to Remote Code Execution (RCE) via Arbitrary File Upload in checkAcesso.php.
EPSS 46%
Critical 9.1
CVE-2024-34783 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 43%
Critical 9.1
CVE-2024-32848 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 43%
Critical 9.8
CVE-2024-41874 ColdFusion | Deserialization of Untrusted Data (CWE-502)
Adobe · ColdFusion

EPSS 30%
Critical 9.1
CVE-2024-34785 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 25%
Critical 9.1
CVE-2024-32840 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 25%
Critical 9.1
CVE-2024-34779 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 24%
Critical 9.1
CVE-2024-32845 An unspecified SQL injection in Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote authenticated attacker with admin privileges to achiev…
ivanti · EPM

EPSS 24%
Critical 9.1
CVE-2024-8669 Backuply – Backup, Restore, Migrate and Clone <= 1.3.4 - Authenticated (Admin+) SQL Injection
Softaculous · Backuply – Backup, Restore, Migrate and Clone

EPSS 17%
Critical 9.8
CVE-2024-43491 Microsoft Windows Update Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507

EPSS 13%
Critical 10.0
CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
SAML-Toolkits · ruby-saml

EPSS 12%
Critical 10.0
CVE-2024-8529 LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
ThimPress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses

EPSS 12%

All 68 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2024-8190 An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain rem…
ivanti · CSA (Cloud Services Appliance)

EPSS 89%
High 8.8
CVE-2024-8504 VICIdial Authenticated Remote Code Execution
VICIdial · VICIdial

EPSS 76%
High 8.2
CVE-2024-37397 An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthen…
ivanti · EPM

EPSS 59%
High 8.8
CVE-2024-43461 Windows MSHTML Platform Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 54%
High 8.8
CVE-2024-38018 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 51%
High 7.5
CVE-2024-46938 An issue was discovered in Sitecore Experience Platform (XP), Experience Manager (XM), and Experience Commerce (XC) 8.0 Initial Release through 10.4 Initial Re…
EPSS 47%
High 7.5
CVE-2024-8124 Inefficient Regular Expression Complexity in GitLab
GitLab · GitLab

EPSS 40%
High 7.2
CVE-2024-43464 Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition

EPSS 36%

Advisories

SUSE-SU-2024:3194-1 Security update for the Linux Kernel 394 CVEs
SUSE-SU-2024:3195-1 Security update for the Linux Kernel 393 CVEs
SUSE-SU-2024:3209-1 Security update for the Linux Kernel 292 CVEs
SUSE-SU-2024:3190-1 Security update for the Linux Kernel 292 CVEs
USN-7008-1 linux-lowlatency-hwe-6.8 vulnerabilities 222 CVEs
USN-7004-1 linux-azure vulnerabilities 221 CVEs
USN-6999-1 linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-lowlatency, linux-oem-6.8, linux-oracle vulnerabilities 220 CVEs
USN-7009-1 linux-azure, linux-azure-5.15, linux-azure-fde vulnerabilities 219 CVEs
USN-7005-2 linux-nvidia-6.8 vulnerabilities 219 CVEs
USN-7007-1 linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-gkeop-5.15, linux-hwe-5.15, linux-ibm, linux-intel-iotg, linux-intel-iotg-5.15, linux-kvm, linux-nvidia, linux-oracle, linux-raspi vulnerabilities 219 CVEs