Week 36, 2024
2 September to 8 September 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 536CVEs publishedin the whole week
- 70CriticalCVSS 9.0 and above
- 195HighCVSS 7.0 to 8.9
- 3Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-7262
Arbitrary Code Execution in WPS Office
Kingsoft · WPS Office
ExploitedCritical9.3 - CVE-2021-20124
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. An unauthenticated…
Draytek VigorConnect
ExploitedHigh7.5 - CVE-2021-20123
A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet endpoint. An…
Draytek VigorConnect
ExploitedHigh7.5
Most severe new CVEsBy CVSS score
- CVE-2024-7591
Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection
Progress · LoadMaster
Critical10.0 - CVE-2024-44984
bnxt_en: Fix double DMA unmapping for XDP_REDIRECT
Linux · Linux
Critical10.0 - CVE-2024-6445
Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX
DataFlowX Technology · DataDiodeX
Critical10.0 - CVE-2024-39714
A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server.
Veeam · Veeam Service Provider Console
Critical9.9 - CVE-2024-38650
An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.
Veeam · Veeam Service Provider Console
Critical9.9 - CVE-2024-45076
IBM webMethods Integration code execution
IBM · webMethods Integration
Critical9.9 - CVE-2024-8463
File upload restriction bypass vulnerability in Job Portal
PHPGurukul · Job Portal
Critical9.9 - CVE-2024-45195
Apache OFBiz: Confused controller-view authorization logic (forced browsing)
Apache Software Foundation · Apache OFBiz
ExploitedCritical9.8 - CVE-2024-20439
A vulnerability in Cisco Smart Licensing Utility (CSLU) could allow an unauthenticated, remote attacker to log into an affected system by using a static…
Cisco · Cisco Smart License Utility
ExploitedCritical9.8 - CVE-2024-40711
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
Veeam · Backup and Recovery
ExploitedCritical9.8