Week 48, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-11680 ProjectSend Unauthenticated Configuration Modification

  ProjectSend · ProjectSend

  EPSS 92%
• Critical 9.9
  CVE-2024-42327 SQL injection in user.get API

  Zabbix · Zabbix

  EPSS 79%
• Critical 9.8
  CVE-2024-53676 A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.

  Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support

  EPSS 56%
• Critical 9.1
  CVE-2024-33610 "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information inclu…

  Toshiba Tec · Sharp · Multiple MFPs (multifunction printers) · Multiple MFPs (multifunction printers)

  EPSS 50%
• Critical 9.9
  CVE-2024-8672 Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.0.7 - Authenticated (Contributor+) Remote Code Execution

  Marketing Fire · Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets

  EPSS 45%
• Critical 9.8
  CVE-2024-10542 Spam protection, Anti-Spam, FireWall by CleanTalk <= 6.43.2 - Authorization Bypass via Reverse DNS Spoofing to Unauthenticated Arbitrary Plugin Installation

  cleantalk · Spam protection, Honeypot, Anti-Spam by CleanTalk

  EPSS 15%
• Critical 9.8
  CVE-2024-36622 In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper sanitizati…
  EPSS 2.8%
• Critical 9.0
  CVE-2024-28038 The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character st…

  Toshiba Tec · Sharp · Multiple MFPs (multifunction printers) · Multiple MFPs (multifunction printers)

  EPSS 2.6%
• Critical 9.8
  CVE-2024-11482 A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API and enables remote code execution through command injection, execu…

  Trellix · Trellix Enterprise Security Manager (ESM)

  EPSS 2.5%
• Critical 9.8
  CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file

  Apache Software Foundation · Apache Arrow R package

  EPSS 2.3%
• Critical 9.8
  CVE-2024-52475 WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability

  Information Technology · Wawp

  EPSS 1.9%
• Critical 9.8
  CVE-2024-50672 A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administrator account passw…
  EPSS 1.6%
• Critical 9.8
  CVE-2024-50374 A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur…

  Advantech · EKI-6333AC-1GPO · EKI-6333AC-2GD · EKI-6333AC-2G

  EPSS 1.5%
• Critical 9.8
  CVE-2024-50370 A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur…

  Advantech · EKI-6333AC-2GD · EKI-6333AC-2G · EKI-6333AC-1GPO

  EPSS 1.5%
• Critical 9.8
  CVE-2024-50373 A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur…

  Advantech · EKI-6333AC-2G · EKI-6333AC-1GPO · EKI-6333AC-2GD

  EPSS 1.3%

All 63 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 8.0
  CVE-2024-54003 Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability

  Jenkins Project · Jenkins Simple Queue Plugin

  EPSS 81%
• High 7.3
  CVE-2024-53675 An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.

  Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support

  EPSS 81%
• High 7.3
  CVE-2024-53674 An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.

  Hewlett Packard Enterprise (HPE) · HPE Insight Remote Support

  EPSS 47%
• Medium 4.7
  CVE-2024-11652 EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injection

  EnGenius · ENS500-AC · ENH1350EXT · ENS620EXT

  EPSS 30%
• Medium 4.7
  CVE-2024-11658 EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection

  EnGenius · ENS500-AC · ENH1350EXT · ENS620EXT

  EPSS 29%
• Medium 4.7
  CVE-2024-11657 EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection

  EnGenius · ENS500-AC · ENH1350EXT · ENS620EXT

  EPSS 29%
• Medium 4.7
  CVE-2024-11653 EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injection

  EnGenius · ENH1350EXT · ENS620EXT · ENS500-AC

  EPSS 29%
• Medium 4.7
  CVE-2024-11654 EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection

  EnGenius · ENH1350EXT · ENS620EXT · ENS500-AC

  EPSS 29%