Week 9, 2024
26 February to 3 March 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 827CVEs publishedin the whole week
- 76CriticalCVSS 9.0 and above
- 256HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-29360
Microsoft Streaming Service Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh8.4
Most severe new CVEsBy CVSS score
- CVE-2024-1403
Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
Progress · OpenEdge
Critical10.0 - CVE-2024-27298
Parse Server literalizeRegexPart SQL Injection
parse-community · parse-server
Critical10.0 - CVE-2024-25913
WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload
Skymoonlabs · MoveTo
Critical10.0 - CVE-2024-25925
WordPress WooCommerce Easy Checkout Field Editor, Fees & Discounts Plugin <= 3.5.12 is vulnerable to Arbitrary File Upload
SYSBASICS · WooCommerce Easy Checkout Field Editor, Fees & Discounts
Critical10.0 - CVE-2024-25909
WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Arbitrary File Upload
JoomUnited · WP Media folder
Critical9.9 - CVE-2024-1698
NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection
wpdevteam · NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
Critical9.8 - CVE-2024-24401
SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitoringwizard.php…
Product not named
Critical9.8 - CVE-2024-25830
F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can…
Product not named
Critical9.8 - CVE-2024-27747
File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email Image…
Product not named
Critical9.8 - CVE-2024-27746
SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the email address…
Product not named
Critical9.8