Week 10, 2024
4 March to 10 March 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 583CVEs publishedin the whole week
- 60CriticalCVSS 9.0 and above
- 195HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2024-23296
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2024-23225
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey…
Apple · iOS and iPadOS
ExploitedHigh7.8 - CVE-2021-36380
Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.
Product not named
ExploitedCritical9.8 - CVE-2023-21237
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI.…
Android
ExploitedMedium6.2 - CVE-2024-21338
Windows Kernel Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1809
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2024-2044
Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4
pgadmin.org · pgAdmin 4
Critical9.9 - CVE-2024-27198
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible
JetBrains · TeamCity
ExploitedCritical9.8 - CVE-2024-2054
Artica Proxy Unauthenticated PHP Deserialization Vulnerability
Artica Tech · Artica Proxy
Critical9.8 - CVE-2024-20017
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution with no additional…
MediaTek, Inc. · MT6890, MT7915, MT7916, MT7981, MT7986
Critical9.8 - CVE-2024-21899
QTS, QuTS hero, QuTScloud
QNAP Systems Inc. · QTS
Critical9.8 - CVE-2024-2056
Artica Proxy Loopback Services Remotely Accessible Unauthenticated
Artica Tech · Artica Proxy
Critical9.8 - CVE-2023-38944
An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access control and gain…
Product not named
Critical9.8 - CVE-2024-22857
Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have data upto…
Product not named
Critical9.8 - CVE-2024-27307
JSONata expression can pollute the "Object" prototype
jsonata-js · jsonata
Critical9.8 - CVE-2024-23286
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS…
Apple · iOS and iPadOS
Critical9.8