Week 38, 2024

16–22 September 2024

New CVEs: 640
Critical: 73
High: 219
Newly exploited: 11
Advisories: 5,172
Malicious pkgs: 82

Newly exploited 11

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.4
CVE-2024-8963 KEV Sep 19, 2024 Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
ivanti · CSA (Cloud Services Appliance)

EPSS 99%
Critical 9.8
CVE-2020-0618 KEV Sep 18, 2024 · ransomware A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server Re…
Microsoft · Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) · Microsoft SQL Server · Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)

EPSS 99%
Critical 9.8
CVE-2020-14644 KEV Sep 18, 2024 Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.…
Oracle · WebLogic Server

EPSS 95%
Critical 9.8
CVE-2022-21445 KEV Sep 18, 2024 Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are aff…
Oracle · Application Development Framework (ADF)

EPSS 62%
Critical 9.8
CVE-2024-27348 KEV Sep 18, 2024 Apache HugeGraph-Server: Command execution in gremlin
Apache Software Foundation · Apache HugeGraph-Server

EPSS 99%
High 8.8
CVE-2013-0643 KEV Sep 17, 2024 The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.…
EPSS 11%
High 8.8
CVE-2013-0648 KEV Sep 17, 2024 Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows …
EPSS 11%
High 8.8
CVE-2014-0502 KEV Sep 17, 2024 Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 …
EPSS 25%
High 8.8
CVE-2014-0497 KEV Sep 17, 2024 Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linu…
EPSS 100%
Critical 9.8
CVE-2024-6670 KEV Sep 16, 2024 · ransomware WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
Progress Software · WhatsUp Gold

EPSS 93%
High 8.8
CVE-2024-43461 KEV Sep 16, 2024 Windows MSHTML Platform Spoofing Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 54%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.4
CVE-2024-8963 Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
ivanti · CSA (Cloud Services Appliance)

EPSS 99%
Critical 9.1
CVE-2024-8956 PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
PTZOptics · PT30X-SDI · PT30X-NDI

EPSS 59%
Critical 9.8
CVE-2024-38812 Heap-overflow vulnerability
EPSS 55%
Critical 10.0
CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS
owen2345 · Camaleon CMS

EPSS 37%
Critical 9.8
CVE-2023-27584 Dragonfly2 vulnerable to hard coded cyptographic key
dragonflyoss · Dragonfly2

EPSS 34%
Critical 9.3
CVE-2024-8752 WebIQ 2.15.9 Runtime on Windows - Directory Traversal Vulnerability
Smart HMI · WebIQ

EPSS 12%
Critical 9.4
CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
navidrome · navidrome

EPSS 4.5%
Critical 9.8
CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server
Apache Software Foundation · Apache Seata

EPSS 3.3%
Critical 9.0
CVE-2024-34026 A stack-based buffer overflow vulnerability exists in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC _v3 b4702061dc14d1024856f71b4543298d77007…
OpenPLC · OpenPLC_v3

EPSS 2.4%
Critical 9.1
CVE-2024-7387 Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy
Red Hat · Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.16 · Red Hat OpenShift Container Platform 4.18

EPSS 2.3%
Critical 9.8
CVE-2024-45694 D-Link WiFi router - Stack-based Buffer Overflow
D-Link · DIR-X4860 A1 · DIR-X5460 A1

EPSS 1.9%
Critical 9.8
CVE-2024-45695 D-Link WiFi router - Stack-based Buffer Overflow
D-Link · DIR-X4860 A1

EPSS 1.6%
Critical 9.8
CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
traefik · traefik

EPSS 1.5%
Critical 9.8
CVE-2024-46946 LangChain Experimental Eval Injection vulnerability
EPSS 1.4%
Critical 9.8
CVE-2024-9043 Cellopoint Secure Email Gateway - Buffer Overflow
Cellopoint · Secure Email Gateway

EPSS 1.4%

All 73 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.2
CVE-2024-8957 PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
PTZOptics · PT30X-SDI · PT30X-NDI

EPSS 80%
High 7.5
CVE-2024-46982 Cache Poisoning in next.js
vercel · next.js

EPSS 59%
Medium 4.7
CVE-2024-9076 DedeCMS article_string_mix.php os command injection
EPSS 21%
High 7.5
CVE-2024-38813 Privilege escalation vulnerability
EPSS 17%
Medium 6.3
CVE-2024-9004 D-Link DAR-7000 Backup_Server_commit.php os command injection
D-Link · DAR-7000

EPSS 17%
Medium 5.5
CVE-2024-8945 CodeCanyon RISE Ultimate Project Manager save sql injection
CodeCanyon · RISE Ultimate Project Manager

EPSS 17%
High 7.7
CVE-2024-46987 Arbitrary path traversal in Camaleon CMS
owen2345 · Camaleon CMS

EPSS 15%
High 7.5
CVE-2024-43989 WordPress Justified Image Grid plugin <= 4.6.1 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability
Firsh · Justified Image Grid

EPSS 12%

Advisories

RHSA-2023:6583 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 502 CVEs
USN-7019-1 linux-xilinx-zynqmp vulnerabilities 429 CVEs
RHSA-2023:2458 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 409 CVEs
RHSA-2023:7077 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 321 CVEs
RHSA-2022:7683 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 139 CVEs
SUSE-SU-2024:3252-1 Security update for the Linux Kernel 105 CVEs
SUSE-SU-2024:3251-1 Security update for the Linux Kernel 105 CVEs
RHEA-2018:0705 Red Hat Enhancement Advisory: tcpdump bug fix and enhancement update 91 CVEs
RHSA-2022:1988 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 67 CVEs
SUSE-SU-2024:3249-1 Security update for the Linux Kernel 62 CVEs