Week 30, 2024
22 July to 28 July 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 429CVEs publishedin the whole week
- 53CriticalCVSS 9.0 and above
- 158HighCVSS 7.0 to 8.9
- 2Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2012-4792
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers…
Product not named
ExploitedHigh8.8 - CVE-2024-39891
In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access to certain…
Product not named
ExploitedMedium5.3
Most severe new CVEsBy CVSS score
- CVE-2024-41110
Moby authz zero length regression
moby · moby
Critical10.0 - CVE-2024-6327
Progress Telerik Report Server Deserialization
Progress Software Corporation · Telerik Report Server
Critical9.9 - CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API…
dotCMS · dotCMS core
Critical9.9 - CVE-2023-45249
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61,…
Acronis · Acronis Cyber Infrastructure
ExploitedCritical9.8 - CVE-2024-38289
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to…
Product not named
Critical9.8 - CVE-2024-37084
CVE-2024-37084: Remote code execution in Spring Cloud Data Flow
Spring · Spring Cloud Data Flow
Critical9.8 - CVE-2024-39250
EfroTech Timetrax v8.3 was discovered to contain an unauthenticated SQL injection vulnerability via the q parameter in the search web interface.
Product not named
Critical9.8 - CVE-2024-41468
Tenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the cmdinput parameter at /goform/exeCommand
Product not named
Critical9.8 - CVE-2024-41316
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
Product not named
Critical9.8 - CVE-2024-41318
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode…
Product not named
Critical9.8