Week 25, 2024
17 June to 23 June 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 689CVEs publishedin the whole week
- 51CriticalCVSS 9.0 and above
- 223HighCVSS 7.0 to 8.9
- 0Added to KEVknown exploited, newly listed
Most severe new CVEsBy CVSS score
- CVE-2024-3605
WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
thimpress · WP Hotel Booking
Critical10.0 - CVE-2024-38558
net: openvswitch: fix overwriting ct original tuple for ICMPv6
Linux · Linux
Critical10.0 - CVE-2024-37902
Path thraversal in DeepJavaLibrary
deepjavalibrary · djl
Critical10.0 - CVE-2024-36679
In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. Due to a predictable token, the…
Product not named
Critical10.0 - CVE-2024-34990
In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php…
Product not named
Critical10.0 - CVE-2024-36532
Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Product not named
Critical10.0 - CVE-2024-5853
Image Optimizer, Resizer and CDN – Sirv <= 7.2.6 - Authenticated (Contributor+) Arbitrary File Upload
sirv · Image Optimizer, Resizer and CDN – Sirv
Critical9.9 - CVE-2024-37079
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may…
VMware vCenter Server
ExploitedCritical9.8 - CVE-2024-6047
GeoVision EOL device - OS Command Injection
GeoVision · GV_DSP_LPR_V2
ExploitedCritical9.8 - CVE-2024-37080
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may…
VMware vCenter Server
Critical9.8