Week 50, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-55956 In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerS…
  EPSS 94%
• Critical 9.5
  CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

  Apache Software Foundation · Apache Struts

  EPSS 72%
• Critical 9.8
  CVE-2024-49112 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 72%
• Critical 9.8
  CVE-2024-10124 Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

  ThemeHunk · Vayu Blocks – Website Builder for the Block Editor

  EPSS 33%
• Critical 9.1
  CVE-2024-11773 SQL injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to run arbitrary SQL sta…

  ivanti · Cloud Services Application

  EPSS 23%
• Critical 9.9
  CVE-2024-42448 From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution …

  Veeam · Service Provider Console

  EPSS 20%
• Critical 9.3
  CVE-2024-50339 GLPI vulnerable to unauthenticated session hijacking

  GLPI · glpi

  EPSS 19%
• Critical 9.3
  CVE-2024-55547 Remote Command Execution via SNMP

  ORing · IAP-420

  EPSS 17%
• Critical 9.1
  CVE-2024-11772 Command injection in the admin web console of Ivanti CSA before version 5.0.3 allows a remote authenticated attacker with admin privileges to achieve remote co…

  ivanti · Cloud Services Application

  EPSS 7.7%
• Critical 9.8
  CVE-2023-32117 WordPress Integrate Google Drive plugin <= 1.1.99 - Unauthenticated Broken Access Control vulnerability

  SoftLab · Integrate Google Drive

  EPSS 7.3%
• Critical 10.0
  CVE-2024-11639 An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access

  ivanti · Cloud Services Application

  EPSS 4.9%
• Critical 9.1
  CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto

  golang.org/x/crypto · golang.org/x/crypto/ssh

  EPSS 3.8%
• Critical 9.8
  CVE-2024-9290 Super Backup & Clone - Migrate for WordPress <= 2.3.3 - Unauthenticated Arbitrary File Upload

  azzaroco · Super Backup & Clone - Migrate for WordPress

  EPSS 3.5%
• Critical 9.3
  CVE-2024-54152 Angular Expressions - Remote Code Execution when using locals

  peerigon · angular-expressions

  EPSS 2.2%
• Critical 9.8
  CVE-2024-55875 http4k has a potential XXE (XML External Entity Injection) vulnerability

  http4k · http4k

  EPSS 1.9%

All 95 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.5
  CVE-2024-49113 Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 84%
• Medium 4.4
  CVE-2024-55550 Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sani…
  EPSS 38%
• High 8.7
  CVE-2024-55661 Laravel Pulse Allows Remote Code Execution via Unprotected Query Method

  laravel · pulse

  EPSS 31%
• High 7.8
  CVE-2024-49138 Windows Common Log File System Driver Elevation of Privilege Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 26%
• High 8.1
  CVE-2024-49122 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

  EPSS 21%
• Medium 6.5
  CVE-2024-54502 The issue was addressed with improved checks. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.6, macOS Sequoia 15.2, tvOS 18.2, visio…

  Apple · macOS · iOS and iPadOS · watchOS

  EPSS 17%
• High 8.7
  CVE-2024-55544 Authenticated Command Injection

  ORing · IAP-420

  EPSS 12%
• High 8.1
  CVE-2024-49116 Windows Remote Desktop Services Remote Code Execution Vulnerability

  Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows Server 2022

  EPSS 10%