Week 34, 2024
19 August to 25 August 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 650CVEs publishedin the whole week
- 78CriticalCVSS 9.0 and above
- 238HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-39717
The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with…
Versa · Director
ExploitedMedium6.6 - CVE-2021-33045
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by…
Some Dahua IP Camera, Video Intercom, NVR, XVR devices
ExploitedCritical9.8 - CVE-2021-33044
The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by…
Some Dahua IP Camera, Video Intercom, PTZ Dome Camera, Thermal Camera devices
ExploitedCritical9.8 - CVE-2022-0185
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the…
kernel
ExploitedHigh8.4 - CVE-2021-31196
Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23
ExploitedHigh7.2 - CVE-2024-23897
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character followed by a file path…
Jenkins Project · Jenkins
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2024-5932
GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution
stellarwp · GiveWP – Donation Plugin and Fundraising Platform
Critical10.0 - CVE-2024-7854
Woo Inquiry <= 0.1 - Unauthenticated SQL Injection
sjhoo · Woo Inquiry
Critical10.0 - CVE-2024-37099
WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability
Liquid Web · GiveWP
Critical10.0 - CVE-2024-6386
WPML Multilingual CMS <= 4.6.12 - Authenticated (Contributor+) Remote Code Execution via Twig Server-Side Template Injection
WPML · WPML
Critical9.9 - CVE-2024-43249
WordPress Bit Form Pro plugin <= 2.6.4 - Authenticated Arbitrary File Upload vulnerability
Bit Apps · Bit Form Pro
Critical9.9 - CVE-2024-7954
SPIP porte_plume Plugin Arbitrary PHP Execution
SPIP · SPIP
Critical9.8 - CVE-2024-28000
WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
LiteSpeed Technologies · LiteSpeed Cache
Critical9.8 - CVE-2024-32501
A SQL Injection vulnerability exists in the updateServiceHost functionality in Centreon Web 24.04.x before 24.04.3, 23.10.x before 23.10.13, 23.04.x before…
Product not named
Critical9.8 - CVE-2024-42812
In D-Link DIR-860L v2.03, there is a buffer overflow vulnerability due to the lack of length verification for the SID field in gena.cgi. Attackers who…
Product not named
Critical9.8 - CVE-2024-43202
Apache DolphinScheduler: Remote Code Execution Vulnerability
Apache Software Foundation · Apache DolphinScheduler
Critical9.8