Week 52, 2024

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

• Critical 9.8
  CVE-2024-43441 Apache HugeGraph-Server: Fixed JWT Token(Secret)

  Apache Software Foundation · Apache HugeGraph-Server

  EPSS 73%
• Critical 9.9
  CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

  Apache Software Foundation · Apache Traffic Control

  EPSS 66%
• Critical 10.0
  CVE-2024-52046 Apache MINA: MINA applications using unbounded deserialization may allow RCE

  Apache Software Foundation · Apache MINA

  EPSS 25%
• Critical 9.8
  CVE-2024-56431 oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because…
  EPSS 1.8%
• Critical 9.8
  CVE-2024-11281 WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change

  Webkul · WooCommerce Point of Sale

  EPSS 1.5%
• Critical 9.1
  CVE-2024-40896 In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers …

  libxml2 · libxml2

  EPSS 1.2%
• Critical 9.8
  CVE-2024-50944 Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in…
  EPSS 1%
• Critical 9.8
  CVE-2024-50716 SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id parameter in the /sendPushManually.php compone…
• Critical 9.8
  CVE-2024-50717 SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client parameter in the /recuperaLog.php componen…
• Critical 9.8
  CVE-2024-56521 TCPDF missing certificate validation

  Tecnick · tcpdf

• Critical 9.3
  CVE-2024-12652 Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')

  INTUMIT · SmartRobot′s Conversational AI Platform

• Critical 9.8
  CVE-2024-46873 Multiple SHARP routers leave the hidden debug function enabled. An arbitrary OS command may be executed with the root privilege by a remote unauthenticated att…

  Sharp · home 5G HR02 · Wi-Fi STATION SH-54C · Wi-Fi STATION SH-52B

• Critical 9.8
  CVE-2024-56645 can: j1939: j1939_session_new(): fix skb reference counting

  Linux · Linux

• Critical 9.3
  CVE-2024-56732 HarfBuzz heap-buffer-overflow on hb_cairo_glyphs_from_buffer

  harfbuzz · harfbuzz

• Critical 9.8
  CVE-2024-53206 tcp: Fix use-after-free of nreq in reqsk_timer_handler().

  Linux · Linux

All 29 critical vulnerabilities of the week, day by day →

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• High 7.3
  CVE-2024-12987 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection

  DrayTek · Vigor2960 · Vigor300B

  EPSS 98%
• High 7.2
  CVE-2024-12856 Four-Faith Industrial Router adjust_sys_time OS Command Injection

  Four-Faith · F3x36 · F3x24

  EPSS 84%
• High 8.7
  CVE-2024-55947 Gogs has a Path Traversal in file update API

  Gogs · Gogs

  EPSS 78%
• High 7.3
  CVE-2024-12986 DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection

  DrayTek · Vigor2960 · Vigor300B

  EPSS 36%
• High 7.1
  CVE-2024-3393 PAN-OS: Firewall Denial of Service (DoS) in DNS Security Using a Specially Crafted Packet

  Palo Alto Networks · PAN-OS · Cloud NGFW

  EPSS 30%
• High 8.1
  CVE-2024-53961 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

  Adobe · ColdFusion

  EPSS 14%
• High 7.8
  CVE-2024-53197 ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

  Linux · Linux

  EPSS 4.1%
• Low 2.1
  CVE-2024-56512 Apache NiFi: Missing Complete Authorization for Parameter and Service References

  Apache Software Foundation · Apache NiFi

  EPSS 3.3%