⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips [13 January]
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-10215 | The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4 | 9.8 | <1% | ||
| CVE-2024-11350 | The AdForest theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 5.1.6 | 9.8 | <1% | ||
| CVE-2024-12847 | Unauthenticated Root RCE in NETGEAR DGN1000 via setup.cgi | 9.8 | 30% | PoC ×2 | |
| CVE-2024-12877 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.2… | 9.8 | 1% | ||
| CVE-2024-13239 | Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA) | 9.8 | <1% | ||
| CVE-2024-46981 | Redis: An authenticated user may use a specially crafted Lua script to manipulate the garbage collector and potentially lead to remote… | 9.8 | 8% | PoC ×2 | |
| CVE-2024-50603 | Unauthenticated OS Command Injection (RCE) in Aviatrix Controller | 9.8 | 99% | KEVPoC | KEV |
| CVE-2024-51818 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in radykal Fancy Product Designer… | 9.3 | 16% | ||
| CVE-2024-51919 | Unrestricted Upload of File with Dangerous Type vulnerability in radykal Fancy Product Designer fancy-product-designer.This issue affects Fancy Product Designer | 9.0 | <1% | ||
| CVE-2024-52875 | CRLF Injection/Open Redirect in GFI Kerio Control Enables Reflected XSS and RCE | 8.8 | 30% | PoC ×2 | |
| CVE-2024-53704 | Authentication Bypass in SonicWall SonicOS SSLVPN | 9.8 | 95% | KEVRansomware | KEV |
| CVE-2024-54676 | Unsafe Java deserialization in Apache OpenMeetings clustering deployments | 9.8 | 65% | ||
| CVE-2024-8474 | OpenVPN Connect before version 3.5.0 can contain the configuration profile's clear-text private key which is logged in the application log, which an… | 7.5 | <1% | ||
| CVE-2024-9138 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a high-severity vulnerability, CVE-2024-9138 | 8.6 | 1% | ||
| CVE-2024-9140 | Moxa’s cellular routers, secure routers, and network security appliances are affected by a critical vulnerability, CVE-2024-9140 | 9.3 | 2% | ||
| CVE-2025-0103 | An SQL injection vulnerability in Palo Alto Networks Expedition enables an authenticated attacker to reveal Expedition database contents, such as password… | 9.2 | <1% | ||
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-23016 | FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to… | 9.3 | <1% |
From the original article
9 min read at thehackernews.com
The cyber world’s been buzzing this week, and it’s all about staying ahead of the bad guys. From sneaky software bugs to advanced hacking tricks, the risks are real, but so are the ways to protect yourself. In this recap, we’ll break down what’s happening, why it matters, and what you can do to stay secure.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.