Week 50, 2024
9 December to 15 December 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,279CVEs publishedin the whole week
- 96CriticalCVSS 9.0 and above
- 331HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-50623
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to…
Product not named
ExploitedCritical9.8 - CVE-2024-49138
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2024-11639
An authentication bypass in the admin web console of Ivanti CSA before 5.0.3 allows a remote unauthenticated attacker to gain administrative access
Ivanti · Cloud Services Application
Critical10.0 - CVE-2024-55877
XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList
xwiki · xwiki-platform
Critical10.0 - CVE-2024-21574
The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is…
ltdrdata · ComfyUI-Manager
Critical10.0 - CVE-2024-55662
XWiki allows remote code execution through the extension sheet
xwiki · xwiki-platform
Critical10.0 - CVE-2024-53822
WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability
Genetech · Pie Register Premium
Critical10.0 - CVE-2024-37143
Dell PowerFlex appliance versions prior to IC 46.381.00 and IC 46.376.00, Dell PowerFlex rack versions prior to RCM 3.8.1.0 (for RCM 3.8.x train) and prior to…
Dell · Dell PowerFlex appliance
Critical10.0 - CVE-2024-54261
WordPress TAX SERVICE Electronic HDM plugin <= 1.2.2 - SQL Injection vulnerability
HK Digital Agency LLC · TAX SERVICE Electronic HDM
Critical10.0 - CVE-2024-21577
ComfyUI-Ace-Nodes is vulnerable to Code Injection. The ACE_ExpressionEval node contains an eval() in its entrypoint function that accepts arbitrary…
hay86 · ComfyUI-Ace-Nodes
Critical10.0 - CVE-2024-21576
ComfyUI-Bmad-Nodes is vulnerable to Code Injection. The issue stems from a validation bypass in the BuildColorRangeHSVAdvanced, FilterContour and FindContour…
bmad4ever · ComfyUI-Bmad-Nodes
Critical10.0 - CVE-2024-42448
From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Remote Code Execution…
Veeam · Service Provider Console
Critical9.9