Week 2, 2024
8 January to 14 January 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 856CVEs publishedin the whole week
- 107CriticalCVSS 9.0 and above
- 328HighCVSS 7.0 to 8.9
- 9Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-29357
Microsoft SharePoint Server Elevation of Privilege Vulnerability
Microsoft · Microsoft SharePoint Server 2019
ExploitedCritical9.8 - CVE-2024-21887
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated…
Ivanti · ICS
ExploitedCritical9.1 - CVE-2023-46805
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted…
Ivanti · ICS
ExploitedHigh8.2 - CVE-2023-38203
Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE
Adobe · ColdFusion
ExploitedCritical9.8 - CVE-2023-29300
Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution
Adobe · ColdFusion
ExploitedCritical9.8 - CVE-2016-20017
D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wild in 2016 through…
Product not named
ExploitedCritical9.8 - CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Apache Software Foundation · Apache Superset
ExploitedHigh8.9 - CVE-2023-41990
The issue was addressed with improved handling of caches. This issue is fixed in tvOS 16.3, iOS 16.3 and iPadOS 16.3, macOS Monterey 12.6.8, macOS Big Sur…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2023-23752
[20230201] - Core - Improper access check in webservice endpoints
Joomla! Project · Joomla! CMS
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2023-7028
Weak Password Recovery Mechanism for Forgotten Password in GitLab
GitLab · GitLab
ExploitedCritical10.0 - CVE-2024-21650
XWiki Remote Code Execution vulnerability via user registration
xwiki · xwiki-platform
Critical10.0 - CVE-2024-21663
Remote code execution on ReconServer due to improper input sanitization on the prips command
DEMON1A · Discord-Recon
Critical10.0 - CVE-2023-51438
A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPC647E (All versions…
Siemens · SIMATIC IPC1047E
Critical10.0 - CVE-2023-52218
WordPress WooCommerce Tranzila Gateway Plugin <= 1.0.8 is vulnerable to PHP Object Injection
Anton Bond · Woocommerce Tranzila Payment Gateway
Critical10.0 - CVE-2023-52225
WordPress Taggbox Plugin <= 3.1 is vulnerable to PHP Object Injection
Tagbox · Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics
Critical10.0 - CVE-2024-21669
Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC
hyperledger · aries-cloudagent-python
Critical9.9 - CVE-2023-52219
WordPress Gecka Terms Thumbnails Plugin <= 1.1 is vulnerable to PHP Object Injection
Gecka · Gecka Terms Thumbnails
Critical9.9 - CVE-2023-6875
POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API
saadiqbal · Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
Critical9.8 - CVE-2023-31446
In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. This leads to…
Product not named
Critical9.8