Week 4, 2024
22 January to 28 January 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 488CVEs publishedin the whole week
- 68CriticalCVSS 9.0 and above
- 176HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-22527
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected…
Atlassian · Confluence Data Center
ExploitedCritical10.0 - CVE-2024-23222
A type confusion issue was addressed with improved checks. This issue is fixed in Safari 17.3, iOS 15.8.7 and iPadOS 15.8.7, iOS 16.7.5 and iPadOS 16.7.5, iOS…
Apple · Safari
ExploitedHigh8.8 - CVE-2023-34048
VMware vCenter Server Out-of-Bounds Write Vulnerability
VMware · VMware vCenter Server
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2024-23616
Symantec Server Management Suite Buffer Overflow
Symantec · Server Management Suite
Critical10.0 - CVE-2024-23615
Symantec Messaging Gateway Buffer Overflow
Symantec · Messaging Gateway
Critical10.0 - CVE-2024-23622
IBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer Overflow
IBM Merge Healthcare · eFilm Workstation
Critical10.0 - CVE-2024-23621
IBM Merge Healthcare eFilm Workstation License Server Buffer Overflow
IBM Merge Healthcare · eFilm Workstation
Critical10.0 - CVE-2024-23613
Symantec Deployment Solution Remote Code Execution
Symantec · Deployment Solution
Critical10.0 - CVE-2024-23614
Symantec Messaging Gateway Buffer Overflow
Symantec · Messaging Gateway
Critical10.0 - CVE-2023-52221
WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File Upload
UkrSolution · Barcode Scanner and Inventory manager
Critical10.0 - CVE-2024-0402
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
GitLab · GitLab
Critical9.9 - CVE-2024-20253
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute…
Cisco · Cisco Unified Contact Center Enterprise
Critical9.9 - CVE-2024-23897
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path…
Jenkins Project · Jenkins
ExploitedCritical9.8