Week 47, 2024
18 November to 24 November 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 1,272CVEs publishedin the whole week
- 102CriticalCVSS 9.0 and above
- 519HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-44308
The issue was addressed with improved checks. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and iPadOS 18.1.1, macOS Sequoia…
Apple · Safari
ExploitedHigh8.8 - CVE-2024-21287
Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The supported version…
Oracle Corporation · Oracle Agile PLM Framework
ExploitedHigh7.5 - CVE-2024-44309
A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1 and…
Apple · Safari
ExploitedMedium6.3 - CVE-2024-38812
Heap-overflow vulnerability
VMware vCenter Server
ExploitedCritical9.8 - CVE-2024-38813
Privilege escalation vulnerability
VMware vCenter Server
ExploitedHigh7.5 - CVE-2024-1212
LoadMaster Pre-Authenticated OS Command Injection
Progress Software · LoadMaster
ExploitedCritical10.0 - CVE-2024-0012
PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)
Palo Alto Networks · Cloud NGFW
ExploitedCritical9.3 - CVE-2024-9474
PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface
Palo Alto Networks · Cloud NGFW
ExploitedMedium6.9
Most severe new CVEsBy CVSS score
- CVE-2024-47407
mySCADA myPRO OS Command Injection
mySCADA · myPRO Manager
Critical10.0 - CVE-2024-52034
mySCADA myPRO OS Command Injection
mySCADA · myPRO Manager
Critical10.0 - CVE-2024-8525
Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload
Automated Logic, a Carrier company · WebCTRL
Critical10.0 - CVE-2024-42450
The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function of the Versa…
Versa · Director
Critical10.0 - CVE-2024-9479
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper…
upKeeper Solutions · upKeeper Instant Privilege Access
Critical10.0 - CVE-2024-9478
Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation.This issue affects upKeeper…
upKeeper Solutions · upKeeper Instant Privilege Access
Critical10.0 - CVE-2024-52429
WordPress WP Quick Setup plugin <= 2.0 - Arbitrary Plugin and Theme Installation to Remote Code Execution vulnerability
AntonHoelstad · WP Quick Setup
Critical9.9 - CVE-2024-52427
WordPress Event Tickets with Ticket Scanner plugin <= 2.3.11 - Remote Code Execution (RCE) vulnerability
Vollstart · Event Tickets with Ticket Scanner
Critical9.9 - CVE-2024-52765
H3C GR-1800AX MiniGRW1B0V100R007 is vulnerable to remote code execution (RCE) via the aspForm parameter.
Product not named
Critical9.8 - CVE-2024-28892
An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command execution.…
GoCast · GoCast
Critical9.8