Week 51, 2024

16–22 December 2024

New CVEs: 676
Critical: 75
High: 280
Newly exploited: 8
Advisories: 297
Malicious pkgs: 246

Newly exploited 8

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

Critical 9.8
CVE-2024-12356 KEV Dec 19, 2024 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
BeyondTrust · Remote Support · Privileged Remote Access

EPSS 87%
Critical 9.8
CVE-2018-14933 KEV Dec 18, 2024 upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
EPSS 95%
Critical 9.8
CVE-2022-23227 KEV Dec 18, 2024 NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lac…
EPSS 48%
Critical 9.1
CVE-2021-40407 KEV Dec 18, 2024 An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS…
EPSS 48%
High 7.2
CVE-2019-11001 KEV Dec 18, 2024 On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and…
EPSS 38%
Critical 9.8
CVE-2024-55956 KEV Dec 17, 2024 · ransomware In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerS…
EPSS 94%
High 7.8
CVE-2024-35250 KEV Dec 16, 2024 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Microsoft · Windows Server 2019 · Windows Server 2019 (Server Core installation) · Windows 10 Version 1809

EPSS 25%
High 7.4
CVE-2024-20767 KEV Dec 16, 2024 ColdFusion | Improper Access Control (CWE-284)
Adobe · ColdFusion

EPSS 99%

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.3
CVE-2024-56145 RCE when PHP `register_argc_argv` config setting is enabled in craftcms/cms
craftcms · cms

EPSS 97%
Critical 9.8
CVE-2024-12356 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
BeyondTrust · Remote Support · Privileged Remote Access

EPSS 87%
Critical 9.8
CVE-2024-50379 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
Apache Software Foundation · Apache Tomcat

EPSS 32%
Critical 9.6
CVE-2023-34990 A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via…
Fortinet · FortiWLM

EPSS 25%
Critical 9.8
CVE-2024-29671 Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component.
EPSS 25%
Critical 9.8
CVE-2021-26102 A relative path traversal vulnerability (CWE-23) in FortiWAN version 4.5.7 and below, 4.4 all versions may allow a remote non-authenticated attacker to delete …
Fortinet · FortiWAN

EPSS 20%
Critical 9.8
CVE-2024-56337 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete
Apache Software Foundation · Apache Tomcat

EPSS 9%
Critical 9.8
CVE-2024-54363 WordPress Wp NssUser Register plugin <= 1.0.0 - Privilege Escalation vulnerability
saiful.total · Wp NssUser Register

EPSS 1.9%
Critical 9.3
CVE-2024-55982 WordPress Share Buttons – Social Media plugin <= 1.0.2 - SQL Injection vulnerability
richteam · Share Buttons – Social Media

EPSS 1.8%
Critical 9.8
CVE-2024-56058 WordPress VRPConnector plugin <= 2.0.1 - PHP Object Injection vulnerability
denniskravetstns · VRPConnector

EPSS 1.7%
Critical 9.8
CVE-2024-56059 WordPress Partners plugin <= 0.2.0 - PHP Object Injection vulnerability
farinspace · Partners

EPSS 1.7%
Critical 9.1
CVE-2024-54369 WordPress Zita Site Builder plugin <= 1.0.2 - Arbitrary Plugin Installation and Activation vulnerability
ThemeHunk · Zita Site Builder

EPSS 1.6%
Critical 9.8
CVE-2024-49775 A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2501.0001), Opcenter Intelligence (All versions < V2501.0001), Opcenter Q…
Siemens · SINEC NMS · Totally Integrated Automation Portal (TIA Portal) V18 · Totally Integrated Automation Portal (TIA Portal) V17

EPSS 1.5%
Critical 9.6
CVE-2024-12641 Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE
Chunghwa Telecom · TenderDocTransfer

EPSS 1.4%
Critical 9.8
CVE-2024-12727 A pre-auth SQL injection vulnerability in the email protection feature of Sophos Firewall versions older than 21.0 MR1 (21.0.1) allows access to the reporting …
Sophos · Sophos Firewall

EPSS 1.4%

All 75 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 7.5
CVE-2024-38819 Spring Framework Path Traversal vulnerability
EPSS 56%
Medium 6.6
CVE-2024-12686 Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA)
BeyondTrust · Remote Support(RS) & Privileged Remote Access(PRA)

EPSS 33%
High 7.5
CVE-2024-53991 Potential Backup file leaked via Nginx in Discourse
Discourse · Discourse

EPSS 30%
High 8.8
CVE-2024-53376 CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/subm…
EPSS 11%
High 7.7
CVE-2021-32589 A Use After Free (CWE-416) vulnerability in FortiManager version 7.0.0, version 6.4.5 and below, version 6.2.7 and below, version 6.0.10 and below, version 5.6…
Fortinet · FortiManager · FortiAnalyzer

EPSS 8.9%
Medium 4.7
CVE-2024-2201 CVE-2024-2201
Xen · Xen

EPSS 8.8%
High 8.8
CVE-2024-12692 Type Confusion in V8 in Google Chrome prior to 131.0.6778.204 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi…
Google · Chrome

EPSS 7.1%
High 7.2
CVE-2024-54385 WordPress Radio Player plugin <= 2.0.83 - Server Side Request Forgery (SSRF) vulnerability
princeahmed · Radio Player

EPSS 5.5%

Advisories

SUSE-SU-2024:4387-1 Security update for the Linux Kernel 490 CVEs
SUSE-SU-2024:4364-1 Security update for the Linux Kernel 439 CVEs
SUSE-SU-2024:4376-1 Security update for the Linux Kernel 230 CVEs
USN-7166-3 linux-hwe-5.15 vulnerabilities 167 CVEs
USN-7166-2 linux-aws, linux-aws-5.15 vulnerabilities 167 CVEs
USN-7166-1 linux, linux-gcp, linux-gcp-5.15, linux-gke, linux-gkeop, linux-ibm, linux-ibm-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-oracle, linux-oracle-5.15, linux-raspi vulnerabilities 167 CVEs
SUSE-SU-2024:4367-1 Security update for the Linux Kernel 75 CVEs
SUSE-SU-2024:4345-1 Security update for the Linux Kernel 27 CVEs
SUSE-SU-2024:4346-1 Security update for the Linux Kernel 23 CVEs
openSUSE-SU-2024:14599-1 govulncheck-vulndb-0.0.20241213T205935-1.1 on GA media 21 CVEs