Week 3, 2024
15 January to 21 January 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 597CVEs publishedin the whole week
- 48CriticalCVSS 9.0 and above
- 194HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-35082
An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resources of the…
Ivanti · EPMM
ExploitedCritical10.0 - CVE-2024-0519
Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
Google · Chrome
ExploitedHigh8.8 - CVE-2023-6549
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial of Service and…
Cloud Software Group · NetScaler ADC
ExploitedHigh8.2 - CVE-2023-6548
Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLIP or SNIP with…
Cloud Software Group · NetScaler ADC
ExploitedMedium5.5 - CVE-2018-15133
In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted…
Product not named
ExploitedHigh8.1
Most severe new CVEsBy CVSS score
- CVE-2023-22527
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2021-4434
Social Warfare <= 3.5.2 - Remote Code Execution
warfareplugins · Social Sharing Plugin – Social Warfare
Critical10.0 - CVE-2024-0643
Unrestricted upload of dangerous file types in C21 Live Encoder and Live Mosaic
Cires21 · C21 Live Encoder and Live Mosaic
Critical10.0 - CVE-2023-34063
Aria Automation contains a Missing Access Control vulnerability. An authenticated malicious actor may exploit this vulnerability leading to unauthorized access…
N/A · VMware Aria Automation, VMware Cloud Foundation
Critical9.9 - CVE-2022-1609
The School Management < 9.9.7 - Unauthenticated RCE via REST api
Unknown · school-management-pro
Critical9.8 - CVE-2023-6623
Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion
Unknown · Essential Blocks
Critical9.8 - CVE-2023-0224
GiveWP < 2.24.1 - Unauthenticated SQLi
Unknown · GiveWP
Critical9.8 - CVE-2024-0705
Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
themehigh · Payment Gateway of Stripe for WooCommerce
Critical9.8 - CVE-2023-6816
Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
Red Hat · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
Critical9.8 - CVE-2023-46226
Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
Apache Software Foundation · Apache IoTDB
Critical9.8