Week 39, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-8275 The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection

  stellarwp · The Events Calendar

  EPSS 50%
• Critical 9.0
  CVE-2024-0132 NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

  NVIDIA · Container Toolkit · GPU Operator

  EPSS 41%
• Critical 9.8
  CVE-2024-8353 GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection

  stellarwp · GiveWP – Donation Plugin and Fundraising Platform

  EPSS 33%
• Critical 9.0
  CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

  lobehub · lobe-chat

  EPSS 12%
• Critical 9.9
  CVE-2024-9014 OAuth2 client id and secret exposed through the web browser in pgAdmin 4

  pgadmin.org · pgAdmin 4

  EPSS 9.7%
• Critical 9.1
  CVE-2024-46627 Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests.
  EPSS 4.1%
• Critical 9.8
  CVE-2024-46256 A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to RCE via Add Let's Encrypt Certificate.
  EPSS 3.1%
• Critical 9.3
  CVE-2024-9166 OS Command Injection in Atelmo Atemio AM 520 HD Full HD Satellite Receiver

  Atelmo · Atemio AM 520 HD Full HD Satellite Receiver

  EPSS 1.6%
• Critical 9.8
  CVE-2024-7772 Jupiter X Core <= 4.6.5 - Unauthenticated Arbitrary File Upload

  artbees · Jupiter X Core

  EPSS 1.5%
• Critical 9.8
  CVE-2024-42505 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

  Hewlett Packard Enterprise (HPE) · Aruba OS

  EPSS 1.5%
• Critical 9.8
  CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk

  dataease · dataease

  EPSS 1.4%
• Critical 9.8
  CVE-2024-42507 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

  Hewlett Packard Enterprise (HPE) · Aruba OS

  EPSS 1.4%
• Critical 9.8
  CVE-2024-42506 Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

  Hewlett Packard Enterprise (HPE) · Aruba OS

  EPSS 1.4%
• Critical 9.1
  CVE-2024-7385 WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection

  Ashish Ajani · WP Simple HTML Sitemap

  EPSS 1.4%
• Critical 10.0
  CVE-2024-8878 Unauthenticated Password Reset

  Riello · Netman 204

  EPSS 1.3%

All 58 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.6
  CVE-2024-47076 libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server

  OpenPrinting · libcupsfilters

  EPSS 80%
• Medium 6.9
  CVE-2024-8877 SQL Injection

  Riello · Netman 204

  EPSS 77%
• High 8.6
  CVE-2024-47175 libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer

  OpenPrinting · libppd

  EPSS 64%
• Medium 5.3
  CVE-2024-47176 cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

  OpenPrinting · cups-browsed

  EPSS 51%
• High 7.2
  CVE-2024-6931 The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting

  stellarwp · The Events Calendar

  EPSS 17%
• High 8.0
  CVE-2024-46628 Tenda G3 Router firmware v15.03.05.05 was discovered to contain a remote code execution (RCE) vulnerability via the usbPartitionName parameter in the formSetUS…
  EPSS 12%
• High 8.8
  CVE-2024-9122 Type Confusion in V8 in Google Chrome prior to 129.0.6668.70 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromiu…

  Google · Chrome

  EPSS 6.3%
• High 7.5
  CVE-2024-8484 REST API TO MiniProgram <= 4.7.1 - Unauthenticated SQL Injection

  xjb · REST API TO MiniProgram

  EPSS 3.8%