Week 43, 2024
21 October to 27 October 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 953CVEs publishedin the whole week
- 88CriticalCVSS 9.0 and above
- 329HighCVSS 7.0 to 8.9
- 5Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-37383
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
Product not named
ExploitedMedium6.1 - CVE-2024-20481
A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software…
Cisco · Cisco Adaptive Security Appliance (ASA) Software
ExploitedMedium5.8 - CVE-2024-47575
A missing authentication for critical function in FortiManager 7.6.0, FortiManager 7.4.0 through 7.4.4, FortiManager 7.2.0 through 7.2.7, FortiManager 7.0.0…
Fortinet · FortiManager
ExploitedCritical9.8 - CVE-2024-38094
Microsoft SharePoint Remote Code Execution Vulnerability
Microsoft · Microsoft SharePoint Enterprise Server 2016
ExploitedHigh7.2 - CVE-2024-9537
ScienceLogic SL1 unspecified vulnerability
ScienceLogic · SL1
ExploitedCritical9.3
Most severe new CVEsBy CVSS score
- CVE-2024-49668
WordPress Verbalize WP plugin <= 1.0 - Arbitrary File Upload vulnerability
christopherdewese1099 · Verbalize WP
Critical10.0 - CVE-2024-47901
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12…
Siemens · InterMesh 7177 Hybrid 2.0 Subscriber
Critical10.0 - CVE-2024-49653
WordPress Portfolleo plugin <= 1.2 - Arbitrary File Upload vulnerability
james-eggers · Portfolleo
Critical9.9 - CVE-2024-20329
Cisco Adaptive Security Appliance Software Remote Command Injection Vulnerability
Cisco · Cisco Adaptive Security Appliance (ASA) Software
Critical9.9 - CVE-2024-20424
A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software,…
Cisco · Cisco Firepower Management Center
Critical9.9 - CVE-2024-49658
WordPress Woocommerce Custom Profile Picture plugin <= 1.0 - Arbitrary File Upload vulnerability
ecomerciar · Woocommerce Custom Profile Picture
Critical9.9 - CVE-2024-49652
WordPress 3D Work In Progress plugin <= 1.0.3 - Arbitrary File Upload vulnerability
Renata Bracichowicz · 3D Work In Progress
Critical9.9 - CVE-2024-49669
WordPress INK Official plugin <= 4.1.2 - Arbitrary File Upload vulnerability
Alexander De Ridder · INK Official
Critical9.9 - CVE-2024-49671
WordPress AI Postpix plugin <= 1.1.8 - Arbitrary File Upload vulnerability
Dogu Pekgoz · AI Image Generator for Your Content & Featured Images – AI Postpix
Critical9.9 - CVE-2024-50623
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to…
Product not named
ExploitedCritical9.8