Week 5, 2024
29 January to 4 February 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 537CVEs publishedin the whole week
- 52CriticalCVSS 9.0 and above
- 175HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-21893
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) and Ivanti Neurons…
Ivanti · ICS
ExploitedHigh8.2 - CVE-2022-48618
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with…
Apple · tvOS
ExploitedHigh7.0
Most severe new CVEsBy CVSS score
- CVE-2024-23652
BuildKit possible host system access from mount stub cleaner
moby · buildkit
Critical10.0 - CVE-2023-49617
MachineSense FeverWarn Missing Authentication for Critical Function
MachineSense · FeverWarn
Critical10.0 - CVE-2023-47143
IBM Tivoli Application Dependency Discovery Manager HOST header injection
IBM · Tivoli Application Dependency Discovery Manager
Critical10.0 - CVE-2024-22320
IBM Operational Decision Manager code execution
IBM · Operational Decision Manager
Critical9.8 - CVE-2023-48793
Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
Product not named
Critical9.8 - CVE-2023-48792
Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
Product not named
Critical9.8 - CVE-2024-24329
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortForwardRules…
Product not named
Critical9.8 - CVE-2024-23052
An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() function in the fastjson…
Product not named
Critical9.8 - CVE-2024-23653
BuildKit interactive containers API does not validate entitlements check
moby · buildkit
Critical9.8 - CVE-2023-6943
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to…
Mitsubishi Electric Corporation · EZSocket
Critical9.8