Week 31, 2024
29 July to 4 August 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 787CVEs publishedin the whole week
- 52CriticalCVSS 9.0 and above
- 276HighCVSS 7.0 to 8.9
- 4Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-37085
VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access to an…
VMware ESXi
ExploitedMedium6.8 - CVE-2023-45249
Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61,…
Acronis · Acronis Cyber Infrastructure
ExploitedCritical9.8 - CVE-2024-4879
Jelly Template Injection Vulnerability in ServiceNow UI Macros
ServiceNow · Now Platform
ExploitedCritical9.3 - CVE-2024-5217
Incomplete Input Validation in GlideExpression Script
ServiceNow · Now Platform
ExploitedCritical9.2
Most severe new CVEsBy CVSS score
- CVE-2024-37901
XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
xwiki · xwiki-platform
Critical10.0 - CVE-2024-37906
Admidio has Blind SQL Injection in ecard_send.php
Admidio · admidio
Critical10.0 - CVE-2024-7314
anji-plus AJ-Report Authentication Bypass
anji-plus · AJ-Report
Critical9.8 - CVE-2024-5765
WpStickyBar <= 2.1.0 - Unauthenticated SQLi
Unknown · WpStickyBar
Critical9.8 - CVE-2024-6695
profile-builder <= 3.11.8 - Unauthenticated Privilege Escalation
Unknown · User Profile Builder
Critical9.8 - CVE-2024-38887
An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control…
Product not named
Critical9.8 - CVE-2024-7257
YayExtra – WooCommerce Extra Product Options <= 1.3.7 - Unauthenticated Arbitrary File Upload via handle_upload_file Function
yaycommerce · YayExtra – WooCommerce Extra Product Options
Critical9.8 - CVE-2024-41040
net/sched: Fix UAF when resolving a clash
Linux · Linux
Critical9.8 - CVE-2024-38986
Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via merge…
Product not named
Critical9.8 - CVE-2024-40782
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 17.6, iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS…
Apple · Safari
Critical9.8