Week 37, 2024
9 September to 15 September 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 715CVEs publishedin the whole week
- 70CriticalCVSS 9.0 and above
- 282HighCVSS 7.0 to 8.9
- 7Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-8190
An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain…
Ivanti · CSA (Cloud Services Appliance)
ExploitedHigh7.2 - CVE-2024-38014
Windows Installer Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2024-38226
Microsoft Publisher Security Feature Bypass Vulnerability
Microsoft · Microsoft Office 2019
ExploitedHigh7.3 - CVE-2024-38217
Windows Mark of the Web Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium5.4 - CVE-2024-40766
An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access…
SonicWall · SonicOS
ExploitedCritical9.3 - CVE-2016-3714
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow…
Product not named
ExploitedHigh8.4 - CVE-2017-1000253
Linux distributions that have not patched their long-term kernels with https://git.kernel.org/linus/a87938b2e246b81b4fb713edb371a9fa3c5c3c86 (committed on…
Product not named
ExploitedHigh7.8
Most severe new CVEsBy CVSS score
- CVE-2024-8522
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Critical10.0 - CVE-2024-29847
Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to…
Ivanti · EPM
Critical10.0 - CVE-2024-45409
The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
SAML-Toolkits · ruby-saml
Critical10.0 - CVE-2024-8529
LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_fields'
thimpress · LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
Critical10.0 - CVE-2024-27115
Remote Code Execution through File Upload in SOPlanning before 1.52.02
Simple Online Planning · SO Planning
Critical10.0 - CVE-2024-45032
A vulnerability has been identified in Industrial Edge Management Pro (All versions < V1.9.5), Industrial Edge Management Virtual (All versions < V2.3.1-1).…
Siemens · Industrial Edge Management Pro
Critical10.0 - CVE-2024-6795
Vulnerability in Baxter Connex Health Portal
Baxter · Connex Health Portal
Critical10.0 - CVE-2024-6678
Authentication Bypass by Spoofing in GitLab
GitLab · GitLab
Critical9.9 - CVE-2024-37288
A deserialization issue in Kibana can lead to arbitrary code execution when Kibana attempts to parse a YAML document containing a crafted payload. This issue…
Elastic · Kibana
Critical9.9 - CVE-2024-8503
VICIdial Unauthenticated SQL Injection
VICIdial · VICIdial
Critical9.8