Week 23, 2024
3 June to 9 June 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 796CVEs publishedin the whole week
- 73CriticalCVSS 9.0 and above
- 241HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2017-3506
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are…
Oracle Corporation · WebLogic Server
ExploitedHigh7.4
Most severe new CVEsBy CVSS score
- CVE-2024-25600
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
Codeer Limited · Bricks Builder
Critical10.0 - CVE-2024-0520
Remote Code Execution due to Full Controlled File Write in mlflow/mlflow
mlflow · mlflow/mlflow
Critical10.0 - CVE-2024-5171
heap buffer overflow in libaom
libaom · libaom
Critical10.0 - CVE-2024-5675
Unreliable data deserialization vulnerability in Mentor
Summar Software · Mentor – Employee Portal
Critical10.0 - CVE-2024-3592
Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress <= 9.0.1 - Authenticated (Contributor+) SQL Injection
expresstech · Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker
Critical9.9 - CVE-2024-36393
SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Sysaid · SysAid
Critical9.9 - CVE-2024-4577
Argument Injection in PHP-CGI
PHP Group · PHP
ExploitedCritical9.8 - CVE-2024-29972
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before…
Zyxel · NAS326 firmware
Critical9.8 - CVE-2024-29973
** UNSUPPORTED WHEN ASSIGNED ** The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and…
Zyxel · NAS326 firmware
Critical9.8 - CVE-2024-3408
Authentication Bypass and RCE in man-group/dtale
man-group · man-group/dtale
Critical9.8