Week 40, 2024
30 September to 6 October 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 581CVEs publishedin the whole week
- 34CriticalCVSS 9.0 and above
- 207HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-45519
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes…
Product not named
ExploitedCritical10.0 - CVE-2024-29824
An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to…
Ivanti · EPM
ExploitedCritical9.6 - CVE-2023-25280
OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr…
Product not named
ExploitedCritical9.8 - CVE-2020-15415
On DrayTek Vigor3900, Vigor2960, and Vigor300B devices before 1.5.1, cgi-bin/mainfunction.cgi/cvmcfgupload allows remote command execution via shell…
Product not named
ExploitedCritical9.8 - CVE-2019-0344
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute…
SAP SE · SAP Commerce Cloud (virtualjdbc extension)
ExploitedCritical9.8
Most severe new CVEsBy CVSS score
- CVE-2024-45519
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes…
Product not named
ExploitedCritical10.0 - CVE-2024-42017
An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenario, if the…
Product not named
Critical10.0 - CVE-2024-20432
Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability
Cisco · Cisco Data Center Network Manager
Critical9.9 - CVE-2024-9441
Linear eMerge e3-Series Forgot Password Command Injection
Linear · eMerge e3-Series
Critical9.8 - CVE-2024-24116
An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm.
Product not named
Critical9.8 - CVE-2024-9106
Wechat Social login <= 1.3.0 - Authentication Bypass
xunhuweb · Wechat Social login 微信QQ钉钉登录插件
Critical9.8 - CVE-2024-41276
A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. The application requires users to…
Product not named
Critical9.8 - CVE-2024-45252
Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Elsight · Halo version 11.7.1.5
Critical9.8 - CVE-2024-45251
Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Elsight · Halo version 11.7.1.5
Critical9.8 - CVE-2024-41593
DrayTek Vigor310 devices through 4.3.2.6 allow a remote attacker to execute arbitrary code via the function ft_payload_dns(), because a byte sign-extension…
Product not named
Critical9.8