Week 49, 2024

2–8 December 2024

New CVEs: 741
Critical: 78
High: 318
Newly exploited: 4
Advisories: 344
Malicious pkgs: 166

Newly exploited 4

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 10.0
CVE-2024-51378 KEV Dec 4, 2024 · ransomware getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arb…
EPSS 95%
Critical 9.8
CVE-2024-11680 KEV Dec 3, 2024 ProjectSend Unauthenticated Configuration Modification
ProjectSend · ProjectSend

EPSS 92%
High 7.5
CVE-2023-45727 KEV Dec 3, 2024 Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier all…
North Grid · Proself Enterprise/Standard Edition · Proself Mail Sanitize Edition · Proself Gateway Edition

EPSS 4.8%
High 7.5
CVE-2024-11667 KEV Dec 3, 2024 · ransomware A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware version…
Zyxel · USG FLEX series firmware · ATP series firmware · USG FLEX 50(W) series firmware

EPSS 3%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2024-46909 WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
Progress Software · WhatsUp Gold

EPSS 49%
Critical 9.8
CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
wphealth · WP Umbrella: Update Backup Restore & Monitoring

EPSS 23%
Critical 10.0
CVE-2024-50387 SMB Service
QNAP Systems · SMB Service

EPSS 10%
Critical 9.8
CVE-2024-8785 WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability
Progress Software · WhatsUp Gold

EPSS 9.7%
Critical 9.1
CVE-2024-53900 Mongoose search injection vulnerability
EPSS 4%
Critical 10.0
CVE-2024-48839 Remote Code Execution, RCE
ABB · NEXUS Series · ASPECT-Enterprise · MATRIX Series

EPSS 2.8%
Critical 9.8
CVE-2024-52320 Planet Technology Planet WGS-804HPT Command Injection
PLANET Technology · Planet WGS-804HPT

EPSS 2.3%
Critical 9.5
CVE-2024-50388 HBS 3 Hybrid Backup Sync
QNAP Systems · HBS 3 Hybrid Backup Sync

EPSS 2.3%
Critical 10.0
CVE-2024-48840 Unauthorized Access
ABB · ASPECT-Enterprise · MATRIX Series · NEXUS Series

EPSS 2.1%
Critical 9.3
CVE-2024-54143 openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection
openwrt · asu

EPSS 1.8%
Critical 9.4
CVE-2024-48845 Weak Password Rules/Strength
ABB · NEXUS Series · ASPECT-Enterprise · MATRIX Series

EPSS 1.8%
Critical 10.0
CVE-2024-51550 Data Validation / Sanitization
ABB · ASPECT-Enterprise · MATRIX Series · NEXUS Series

EPSS 1.8%
Critical 9.8
CVE-2024-53908 Django SQL injection in HasKey(lhs, rhs) on Oracle
EPSS 1.4%
Critical 9.8
CVE-2024-53442 whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.
EPSS 1.4%
Critical 9.8
CVE-2024-48871 Planet Technology Planet WGS-804HPT Stack-based Buffer Overflow
PLANET Technology · Planet WGS-804HPT

EPSS 1.4%

All 78 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Medium 5.4
CVE-2024-53457 LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section
EPSS 46%
High 8.0
CVE-2024-53375 An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. A vulnerability exists in the "tmp_get_sites" function of …
EPSS 42%
High 8.8
CVE-2024-46906 WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
Progress Software · WhatsUp Gold

EPSS 40%
High 8.7
CVE-2024-53691 QTS, QuTS hero
QNAP Systems · QTS · QuTS hero

EPSS 23%
High 7.1
CVE-2024-42455 A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserialization by sending a se…
Veeam · Backup & Replication

EPSS 16%
High 7.5
CVE-2024-11728 KiviCare – Clinic & Patient Management System (EHR) <= 3.6.4 - Unauthenticated SQL Injection
Iqonic Design · KiviCare – Clinic & Patient Management System (EHR)

EPSS 14%
High 8.2
CVE-2024-51544 Service Control
ABB · ASPECT-Enterprise · MATRIX Series · NEXUS Series

EPSS 13%
High 8.1
CVE-2024-53703 A vulnerability in the SonicWall SMA100 SSLVPN firmware 10.2.1.13-72sv and earlier versions mod_httprp library loaded by the Apache web server allows remote at…
SonicWall · SMA100

EPSS 13%

Advisories

SUSE-SU-2024:4131-1 Security update for the Linux Kernel 105 CVEs
SUSE-SU-2024:4140-1 Security update for the Linux Kernel 49 CVEs
openSUSE-SU-2024:14536-1 ansible-10-10.6.0-1.1 on GA media 45 CVEs
SUSE-SU-2024:4218-1 Security update for the Linux Kernel (Live Patch 10 for SLE 15 SP5) 34 CVEs
SUSE-SU-2024:4122-1 Security update for the Linux Kernel RT (Live Patch 10 for SLE 15 SP5) 34 CVEs
SUSE-SU-2024:4234-1 Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP4) 31 CVEs
SUSE-SU-2024:4214-1 Security update for the Linux Kernel (Live Patch 11 for SLE 15 SP5) 30 CVEs
SUSE-SU-2024:4123-1 Security update for the Linux Kernel RT (Live Patch 11 for SLE 15 SP5) 30 CVEs
SUSE-SU-2024:4235-1 Security update for the Linux Kernel (Live Patch 25 for SLE 15 SP4) 27 CVEs
SUSE-SU-2024:4256-1 Security update for the Linux Kernel (Live Patch 42 for SLE 15 SP3) 25 CVEs