Week 43, 2024
21–27 October 2024
Newly exploited 5
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
-
Medium 6.1
CVE-2024-37383 KEV Oct 24, 2024 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.EPSS 74%
-
Medium 5.8
CVE-2024-20481 KEV Oct 24, 2024 A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software …EPSS 16%
Cisco · Cisco Firepower Threat Defense Software · Cisco Adaptive Security Appliance (ASA) Software
-
Critical 9.8
CVE-2024-47575 KEV Oct 23, 2024 A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 th…EPSS 95%
-
High 7.2
CVE-2024-38094 KEV Oct 22, 2024 · ransomware Microsoft SharePoint Remote Code Execution VulnerabilityEPSS 51%
Microsoft · Microsoft SharePoint Server 2019 · Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server Subscription Edition
- Critical 9.8 EPSS 3.8%
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2024-50623 In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to re…EPSS 99%
-
Critical 9.1
CVE-2024-41713 A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to c…EPSS 97%
-
Critical 9.8
CVE-2024-47575 A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0 th…EPSS 95%
-
Critical 9.3
CVE-2024-46538 A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the …EPSS 80%
-
Critical 9.8
CVE-2024-35286 A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insuf…EPSS 66%
- Critical 9.8 EPSS 38%
- Critical 9.8 EPSS 19%
-
Critical 9.8
CVE-2024-48904 An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances. Please note: authe…EPSS 2.4%
-
Critical 9.8
CVE-2024-9933 WatchTowerHQ <= 3.10.1 - Authentication Bypass to Administrator due to Missing Empty Value CheckEPSS 2%
-
Critical 9.8
CVE-2024-35314 A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an u…EPSS 1.8%
- Critical 9.1 EPSS 1.6%
- Critical 10.0 EPSS 1.5%
-
Critical 9.8
CVE-2024-35285 A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to i…EPSS 1.3%
-
Critical 10.0
CVE-2024-47901 A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 on…EPSS 1.2%
Siemens · InterMesh 7177 Hybrid 2.0 Subscriber · InterMesh 7707 Fire Subscriber
-
Critical 9.1
CVE-2024-40089 A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell c…EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.8
CVE-2024-45242 EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utilit…EPSS 35%
- High 8.9 EPSS 28%
- High 8.7 EPSS 25%
-
High 7.5
CVE-2024-49357 ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data LeakEPSS 24%
-
High 7.5
CVE-2024-45518 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows …EPSS 21%
- High 7.2 EPSS 18%
-
Medium 5.8
CVE-2024-20481 A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software …EPSS 16%
Cisco · Cisco Firepower Threat Defense Software · Cisco Adaptive Security Appliance (ASA) Software
- High 7.2 EPSS 15%
Advisories
- Red Hat Security Advisories (RHSA) 22031 critical
- Amazon Linux Security Center (ALAS) 47
- BSI CERT-Bund (WID) 402 critical
- Rocky Linux Security Advisories 31
- SUSE / openSUSE Security Updates 302 critical
- Debian Security (DSA / DLA) 173 critical
- Oracle Linux Security Advisories (ELSA) 12
- Ubuntu Security Notices (USN) 9
- AlmaLinux Security Advisories 6
- CISA ICS & IT advisories 51 critical
- NCSC-NL (Netherlands) 21 critical
- CERT@VDE 21 critical
- Siemens ProductCERT 11 critical
- RHSA-2020:4847 Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update 17 CVEs
- RHSA-2023:6939 Red Hat Security Advisory: container-tools:rhel8 security and bug fix update 17 CVEs
- RHSA-2023:1742 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update 16 CVEs
- RHSA-2023:6938 Red Hat Security Advisory: container-tools:4.0 security and bug fix update 16 CVEs
- WID-SEC-2024-3286 Red Hat Enterprise Linux: Mehrere Schwachstellen 12 CVEs
- RHSA-2023:1533 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update 11 CVEs
- SUSE-SU-2024:3755-1 Security update for go1.21-openssl 10 CVEs
- RHSA-2022:0350 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update 9 CVEs
- RHSA-2022:0246 Red Hat Security Advisory: nodejs:14 security, bug fix, and enhancement update 9 CVEs
- RHEA-2022:5139 Red Hat Enhancement Advisory: nodejs:12 bug fix and enhancement update 9 CVEs