Week 7, 2024
12 February to 18 February 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 689CVEs publishedin the whole week
- 75CriticalCVSS 9.0 and above
- 265HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-21410
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23
ExploitedCritical9.8 - CVE-2020-3259
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Information Disclosure Vulnerability
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedHigh7.5 - CVE-2024-21412
Internet Shortcut Files Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.1 - CVE-2024-21351
Windows SmartScreen Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.6 - CVE-2023-43770
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of…
Product not named
ExploitedMedium6.1
Most severe new CVEsBy CVSS score
- CVE-2024-25100
WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability
WP Swings · Coupon Referral Program
Critical10.0 - CVE-2024-25108
Insufficient authorization allowing elevated access to resources in pixelfed
pixelfed · pixelfed
Critical9.9 - CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft · Microsoft 365 Apps for Enterprise
ExploitedCritical9.8 - CVE-2024-23113
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions…
Fortinet · FortiSwitchManager
ExploitedCritical9.8 - CVE-2024-21410
Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23
ExploitedCritical9.8 - CVE-2024-1512
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
stylemix · MasterStudy LMS WordPress Plugin – for Online Courses and Education
Critical9.8 - CVE-2024-23759
Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the…
Product not named
Critical9.8 - CVE-2024-25110
Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Azure · azure-uamqp-c
Critical9.8 - CVE-2022-23088
802.11 heap buffer overflow
FreeBSD · FreeBSD
Critical9.8 - CVE-2023-32462
Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote…
Dell · Dell SmartFabric OS10
Critical9.8