Week 40, 2024

30 September – 6 October 2024

New CVEs: 587
Critical: 34
High: 212
Newly exploited: 5
Advisories: 921
Malicious pkgs: 74

Newly exploited 5

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2024-45519 KEV Oct 3, 2024 The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allow…
EPSS 100%
Critical 9.6
CVE-2024-29824 KEV Oct 2, 2024 An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execut…
ivanti · EPM

EPSS 100%
Critical 9.8
CVE-2023-25280 KEV Sep 30, 2024 OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parame…
EPSS 98%
Critical 9.8
CVE-2020-15415 KEV Sep 30, 2024 On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell metacharac…
EPSS 84%
Critical 9.8
CVE-2019-0344 KEV Sep 30, 2024 Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbi…
SAP · SAP Commerce Cloud (virtualjdbc extension)

EPSS 7.5%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

All 34 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2024-41163 A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafted HTTP request can lead to a disclosure …
Veertu · Anka Build

EPSS 52%
Medium 6.9
CVE-2024-47841 Path traversal when loading stylesheets
The Wikimedia Foundation · Mediawiki - CSS Extension

EPSS 35%
High 7.5
CVE-2024-47525 Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
librenms · librenms

EPSS 30%
High 8.0
CVE-2024-46658 Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability.
EPSS 24%
High 8.8
CVE-2024-7855 WP Hotel Booking <= 2.1.2 - Authenticated (Subscriber+) Arbitrary File Upload
ThimPress · WP Hotel Booking

EPSS 18%
Medium 5.3
CVE-2024-47855 JSON-lib mishandles an unbalanced comment string
EPSS 18%
High 8.5
CVE-2024-9054 Remote code Execution inTimeProvider® 4100
Microchip · TimeProvider 4100

EPSS 16%
Medium 5.4
CVE-2024-43686 Reflected XSS in TimeProvider 4100 chart component
Microchip · TimeProvider 4100

EPSS 13%

Advisories

RHSA-2022:8267 Red Hat Security Advisory: kernel security, bug fix, and enhancement update 196 CVEs
RHSA-2024:5101 Red Hat Security Advisory: kernel security update 170 CVEs
RHSA-2024:7000 Red Hat Security Advisory: kernel security update 151 CVEs
RHSA-2024:5102 Red Hat Security Advisory: kernel-rt security update 149 CVEs
DSA-5782-1 linux - security update 145 CVEs
RHSA-2024:7001 Red Hat Security Advisory: kernel-rt security update 129 CVEs
USN-7003-5 linux-raspi-5.4 vulnerabilities 85 CVEs
RHSA-2024:3618 Red Hat Security Advisory: kernel update 59 CVEs
RHSA-2024:3627 Red Hat Security Advisory: kernel-rt security and bug fix update 53 CVEs
RHSA-2024:5363 Red Hat Security Advisory: kernel security update 47 CVEs