Week 15, 2024
8 April to 14 April 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 961CVEs publishedin the whole week
- 68CriticalCVSS 9.0 and above
- 354HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Palo Alto Networks · PAN-OS
ExploitedCritical10.0 - CVE-2024-3272
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi hard-coded credentials
D-Link · DNS-320L
ExploitedCritical9.8 - CVE-2024-3273
D-Link DNS-320L/DNS-325/DNS-327L/DNS-340L HTTP GET Request nas_sharing.cgi command injection
D-Link · DNS-320L
ExploitedHigh7.3
Most severe new CVEsBy CVSS score
- CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
Palo Alto Networks · PAN-OS
ExploitedCritical10.0 - CVE-2024-31984
XWiki Platform: Remote code execution through space title and Solr space facet
xwiki · xwiki-platform
Critical10.0 - CVE-2024-31465
XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
xwiki · xwiki-platform
Critical10.0 - CVE-2024-31997
XWiki Platform remote code execution from account through UIExtension parameters
xwiki · xwiki-platform
Critical10.0 - CVE-2023-51409
WordPress AI Engine plugin <= 1.9.98 - Unauthenticated Arbitrary File Upload vulnerability
Jordy Meow · AI Engine: ChatGPT Chatbot
Critical10.0 - CVE-2024-31982
XWiki Platform: Remote code execution as guest via DatabaseSearch
xwiki · xwiki-platform
Critical10.0 - CVE-2024-24576
Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
rust-lang · rust
Critical10.0 - CVE-2024-31996
XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
xwiki · xwiki-commons
Critical10.0 - CVE-2024-31987
XWiki Platform remote code execution from account via custom skins support
xwiki · xwiki-platform
Critical10.0 - CVE-2024-31983
XWiki Platform: Remote code execution from edit in multilingual wikis via translations
xwiki · xwiki-platform
Critical10.0