Week 29, 2024
15 July to 21 July 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 685CVEs publishedin the whole week
- 66CriticalCVSS 9.0 and above
- 183HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-34102
XXE can expose crypt key and other secrets granting full admin access
Adobe · Adobe Commerce
ExploitedCritical9.8 - CVE-2024-28995
SolarWinds Serv-U L Directory Transversal Vulnerability
SolarWinds · SolarWinds Serv-U
ExploitedHigh8.6 - CVE-2022-22948
The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative access to…
VMware vCenter Server and VMware Cloud Foundation
ExploitedMedium6.5 - CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
geoserver · geoserver
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2024-20419
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change…
Cisco · Cisco Smart Software Manager On-Prem
Critical10.0 - CVE-2024-39911
1Panel SQL injection
1Panel-dev · 1Panel
Critical10.0 - CVE-2024-40629
Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
jumpserver · jumpserver
Critical10.0 - CVE-2024-39700
Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action
jupyterlab · extension-template
Critical10.0 - CVE-2024-40628
Arbitrary File Read in Ansible Playbooks in Jumpserver
jumpserver · jumpserver
Critical10.0 - CVE-2024-39915
Authenticated remote code execution in Thruk
sni · Thruk
Critical10.0 - CVE-2024-5618
Broken Access Control in PruvaSoft Informatics' Apinizer Management Console
PruvaSoft Informatics · Apinizer Management Console
Critical9.9 - CVE-2024-6220
简数采集器 (Keydatas) <= 2.5.2 - Unauthenticated Arbitrary File Upload
zhengdon · 简数采集器
Critical9.8 - CVE-2024-39907
a sqlinjection in 1Panel
1Panel-dev · 1Panel
Critical9.8 - CVE-2024-6457
HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection
realmag777 · HUSKY – Products Filter Professional for WooCommerce
Critical9.8