Week 38, 2024
16 September to 22 September 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 634CVEs publishedin the whole week
- 72CriticalCVSS 9.0 and above
- 218HighCVSS 7.0 to 8.9
- 11Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-8963
Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality.
Ivanti · CSA (Cloud Services Appliance)
ExploitedCritical9.4 - CVE-2024-27348
Apache HugeGraph-Server: Command execution in gremlin
Apache Software Foundation · Apache HugeGraph-Server
ExploitedCritical9.8 - CVE-2022-21445
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are…
Oracle Corporation · Application Development Framework (ADF)
ExploitedCritical9.8 - CVE-2020-14644
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0,…
Oracle Corporation · WebLogic Server
ExploitedCritical9.8 - CVE-2020-0618
A remote code execution vulnerability exists in Microsoft SQL Server Reporting Services when it incorrectly handles page requests, aka 'Microsoft SQL Server…
Microsoft · Microsoft SQL Server
ExploitedCritical9.8 - CVE-2014-0502
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341…
Product not named
ExploitedHigh8.8 - CVE-2014-0497
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on…
Product not named
ExploitedHigh8.8 - CVE-2013-0648
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows…
Product not named
ExploitedHigh8.8 - CVE-2013-0643
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before…
Product not named
ExploitedHigh8.8 - CVE-2024-6670
WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability
Progress Software Corporation · WhatsUp Gold
ExploitedCritical9.8 - CVE-2024-43461
Windows MSHTML Platform Spoofing Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh8.8
Most severe new CVEsBy CVSS score
- CVE-2024-46986
Arbitrary file write leading to RCE in Camaleon CMS
owen2345 · camaleon-cms
Critical10.0 - CVE-2024-45798
Multiple Poisoned Pipeline Execution (PPE) vulnerabilities
espressif · arduino-esp32
Critical10.0 - CVE-2024-44146
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
Apple · macOS
Critical10.0 - CVE-2024-44148
This issue was addressed with improved validation of file attributes. This issue is fixed in macOS Sequoia 15. An app may be able to break out of its sandbox.
Apple · macOS
Critical10.0 - CVE-2024-8887
Authentication bypass vulnerability on CIRCUTOR Q-SMT
CIRCUTOR · CIRCUTOR Q-SMT
Critical10.0 - CVE-2024-8888
Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT
CIRCUTOR · CIRCUTOR Q-SMT
Critical10.0 - CVE-2024-45496
Openshift-controller-manager: elevated build pods can lead to node compromise in openshift
openshift-controller-manager
Critical9.9 - CVE-2024-33109
Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via…
Product not named
Critical9.9 - CVE-2024-8767
Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel &…
Acronis · Acronis Backup plugin for cPanel & WHM
Critical9.9 - CVE-2024-38812
Heap-overflow vulnerability
VMware vCenter Server
ExploitedCritical9.8