Week 13, 2024
25 March to 31 March 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 991CVEs publishedin the whole week
- 96CriticalCVSS 9.0 and above
- 361HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2023-24955
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh7.2 - CVE-2021-44529
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited…
Ivanti EPM
ExploitedCritical9.8 - CVE-2019-7256
Linear eMerge E3-Series devices allow Command Injections.
Product not named
ExploitedCritical9.8 - CVE-2023-48788
A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS…
Fortinet · FortiClientEMS
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2024-3094
Xz: malicious code in distributed source
xz
Critical10.0 - CVE-2024-29201
JumpServer's insecure Ansible playbook validation leads to RCE in Celery
jumpserver · jumpserver
Critical10.0 - CVE-2024-29202
JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
jumpserver · jumpserver
Critical10.0 - CVE-2024-30247
Command Injection as root in NextCloudPi web panel
nextcloud · nextcloudpi
Critical10.0 - CVE-2023-23656
WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability
MainWP · MainWP File Uploader Extension
Critical10.0 - CVE-2024-2086
Integrate Google Drive <= 1.3.8 - Missing Authorization to Unauthenticated Settings Modification and Export
princeahmed · File Manager for Google Drive – Integrate Google Drive
Critical10.0 - CVE-2024-30224
WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability
Wholesale Team · WholesaleX
Critical10.0 - CVE-2024-30225
WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability
WPENGINE, INC. · WP Migrate
Critical10.0 - CVE-2024-30510
WordPress Salon booking system plugin <= 9.5 - Arbitrary File Upload vulnerability
Salon Booking System · Salon booking system
Critical10.0 - CVE-2024-31115
WordPress Chauffeur Taxi Booking System for WordPress plugin <= 7.2 - Arbitrary File Upload vulnerability
QuanticaLabs · Chauffeur Taxi Booking System for WordPress
Critical10.0