Week 45, 2024

4–10 November 2024

New CVEs: 920
Critical: 72
High: 346
Newly exploited: 6
Advisories: 299
Malicious pkgs: 364

Newly exploited 6

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2024-51567 KEV Nov 7, 2024 · ransomware upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary …
EPSS 84%
Critical 9.8
CVE-2019-16278 KEV Nov 7, 2024 Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.
EPSS 99%
Critical 9.3
CVE-2024-5910 KEV Nov 7, 2024 Expedition: Missing Authentication Leads to Admin Account Takeover
Palo Alto Networks · Expedition

EPSS 92%
High 7.3
CVE-2024-43093 KEV Nov 7, 2024 In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due…
Google · Android
Critical 9.1
CVE-2024-8956 KEV Nov 4, 2024 PTZOptics NDI and SDI Cameras /cgi-bin/param.cgi Insufficient Authentication
PTZOptics · PT30X-SDI · PT30X-NDI

EPSS 59%
High 7.2
CVE-2024-8957 KEV Nov 4, 2024 PTZOptics NDI and SDI Cameras Command Injection via NTP Address Configuration
PTZOptics · PT30X-NDI · PT30X-SDI

EPSS 80%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 10.0
CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs
Ericsson · CodeChecker

EPSS 40%
Critical 9.8
CVE-2024-10470 WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
VibeThemes · WPLMS Learning Management System for WordPress, WordPress LMS

EPSS 35%
Critical 10.0
CVE-2024-20418 Cisco Ultra-Reliable Wireless Backhaul Software Command Injection Vulnerability
Cisco · Cisco Aironet Access Point Software (IOS XE Controller)

EPSS 3.2%
Critical 9.8
CVE-2024-51211 SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input…
EPSS 2.3%
Critical 9.8
CVE-2024-10586 Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
Eugen Bobrowski · Debug Tool

EPSS 2.1%
Critical 9.8
CVE-2024-42509 Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10

EPSS 2%
Critical 9.8
CVE-2024-51132 HAPI FHIR XML External Entity (XXE) vulnerability
EPSS 1.9%
Critical 9.8
CVE-2020-8007 The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection via three fields of the c…
EPSS 1.7%
Critical 9.8
CVE-2024-51115 DCME-320 v7.4.12.90 was discovered to contain a command injection vulnerability.
EPSS 1.7%
Critical 9.8
CVE-2024-48061 Langflow vulnerable to remote code execution
EPSS 1.5%
Critical 9.8
CVE-2024-10508 RegistrationMagic – User Registration Plugin with Custom Registration Forms <= 6.0.2.6 - Unauthenticated Privilege Escalation via Password Recovery
Metagauss · RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login

EPSS 1.5%
Critical 9.1
CVE-2024-45763 Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul…
Dell · Enterprise SONiC OS

EPSS 1.4%
Critical 9.1
CVE-2024-45765 Dell Enterprise SONiC OS, version(s) 4.1.x, 4.2.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vul…
Dell · Enterprise SONiC OS

EPSS 1.4%
Critical 9.0
CVE-2024-47460 Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol
Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Access Points, Instant AOS-8, and AOS-10

EPSS 1.4%
Critical 9.3
CVE-2024-47073 Dataease arbitrary interface access vulnerability
dataease · dataease

EPSS 1.3%

All 72 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.1
CVE-2024-10914 D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
D-Link · DNS-320 · DNS-340L · DNS-325

EPSS 98%
High 8.1
CVE-2024-43425 Moodle: remote code execution via calculated question types
EPSS 88%
High 8.1
CVE-2024-10915 D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
D-Link · DNS-320 · DNS-340L · DNS-325

EPSS 83%
Medium 6.1
CVE-2024-50599 A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endp…
EPSS 64%
High 7.3
CVE-2024-50340 Ability to change environment from query in symfony/runtime
symfony · symfony

EPSS 62%
High 8.8
CVE-2024-24409 Privilege Escalation
ManageEngine · ADManager Plus

EPSS 6.2%
Medium 6.3
CVE-2024-10919 didi Super-Jacoco triggerUnitCover os command injection
didi · Super-Jacoco

EPSS 5.1%
High 8.3
CVE-2024-9459 SQL Injection
ManageEngine · Exchange Reporter Plus

EPSS 4.5%

Advisories

USN-7095-1 linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency vulnerabilities 197 CVEs
USN-7089-3 linux-aws, linux-aws-6.8, linux-oracle, linux-oracle-6.8 vulnerabilities 196 CVEs
USN-7089-2 linux-azure, linux-gcp, linux-ibm vulnerabilities 196 CVEs
USN-7088-4 linux-aws, linux-azure-5.4, linux-kvm, linux-oracle, linux-xilinx-zynqmp vulnerabilities 162 CVEs
USN-7088-3 linux-aws-5.4, linux-oracle-5.4 vulnerabilities 162 CVEs
USN-7088-2 linux-azure, linux-bluefield vulnerabilities 162 CVEs
openSUSE-SU-2024:0350-1 Security update for govulncheck-vulndb 56 CVEs
SUSE-SU-2024:3911-1 Security update for govulncheck-vulndb 44 CVEs
SUSE-SU-2024:3938-1 Security update for go1.22-openssl 14 CVEs
SUSE-SU-2024:3880-1 Security update for the Linux Kernel (Live Patch 0 for SLE 15 SP6) 13 CVEs