Week 49, 2024
2 December to 8 December 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 728CVEs publishedin the whole week
- 74CriticalCVSS 9.0 and above
- 317HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-51378
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute…
Product not named
ExploitedCritical10.0 - CVE-2024-11680
ProjectSend Unauthenticated Configuration Modification
ProjectSend · ProjectSend
ExploitedCritical9.8 - CVE-2024-11667
A directory traversal vulnerability in the web management interface of Zyxel ATP series firmware versions V5.00 through V5.38, USG FLEX series firmware…
Zyxel · ATP series firmware
ExploitedHigh7.5 - CVE-2023-45727
Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1.08 and earlier…
North Grid Corporation · Proself Enterprise/Standard Edition
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2024-50387
SMB Service
QNAP Systems Inc. · SMB Service
Critical10.0 - CVE-2024-10905
IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
SailPoint Technologies · IdentityIQ
Critical10.0 - CVE-2024-54214
WordPress Revy plugin <= 1.18 - Unauthenticated Arbitrary File Upload vulnerability
roninwp · Revy
Critical10.0 - CVE-2024-52476
WordPress Fediverse Embeds plugin <= 1.5.3 - Arbitrary File Upload vulnerability
Stefan Bohacek · Fediverse Embeds
Critical10.0 - CVE-2018-9416
In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause. This could lead to local escalation of privilege with…
Google · Android
Critical10.0 - CVE-2024-46909
WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
Progress Software Corporation · WhatsUp Gold
Critical9.8 - CVE-2024-12209
WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
wphealth · WP Umbrella: Update Backup Restore & Monitoring
Critical9.8 - CVE-2024-8785
WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability
Progress Software Corporation · WhatsUp Gold
Critical9.8 - CVE-2024-53908
An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup,…
Product not named
Critical9.8 - CVE-2024-53442
whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.
Product not named
Critical9.8