Week 41, 2024
7 October to 13 October 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 756CVEs publishedin the whole week
- 64CriticalCVSS 9.0 and above
- 333HighCVSS 7.0 to 8.9
- 6Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-23113
A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions…
Fortinet · FortiSwitchManager
ExploitedCritical9.8 - CVE-2024-9380
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges…
Ivanti · CSA (Cloud Services Appliance)
ExploitedHigh7.2 - CVE-2024-9379
SQL injection in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to run arbitrary SQL…
Ivanti · CSA (Cloud Services Appliance)
ExploitedMedium6.5 - CVE-2024-43572
Microsoft Management Console Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2024-43047
Use After Free in DSP Service
Qualcomm, Inc. · Snapdragon
ExploitedHigh7.8 - CVE-2024-43573
Windows MSHTML Platform Spoofing Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedMedium6.5
Most severe new CVEsBy CVSS score
- CVE-2024-47875
DOMPurify nesting-based mXSS
cure53 · DOMPurify
Critical10.0 - CVE-2024-9463
Expedition: Unauthenticated OS Command Injection Vulnerability Leads to Firewall Credential Disclosure
Palo Alto Networks · Expedition
ExploitedCritical9.9 - CVE-2024-43468
Microsoft Configuration Manager Remote Code Execution Vulnerability
Microsoft · Microsoft Configuration Manager
ExploitedCritical9.8 - CVE-2024-9680
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this…
Mozilla · Firefox
ExploitedCritical9.8 - CVE-2024-9047
WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php
nickboss · Iptanus File Upload
Critical9.8 - CVE-2024-42640
angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an…
Product not named
Critical9.8 - CVE-2024-9234
GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload
ataurr · GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
Critical9.8 - CVE-2024-9707
Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation
themehunk · Hunk Companion
Critical9.8 - CVE-2024-21534
All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary…
jsonpath-plus
Critical9.8 - CVE-2024-44349
A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands via the username…
Product not named
Critical9.8