Week 51, 2024
16 December to 22 December 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 668CVEs publishedin the whole week
- 76CriticalCVSS 9.0 and above
- 269HighCVSS 7.0 to 8.9
- 8Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2024-12356
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
BeyondTrust · Remote Support
ExploitedCritical9.8 - CVE-2022-23227
NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the…
Product not named
ExploitedCritical9.8 - CVE-2018-14933
upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
Product not named
ExploitedCritical9.8 - CVE-2021-40407
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At [1] or [2], based on DDNS…
Product not named
ExploitedCritical9.1 - CVE-2019-11001
On Reolink RLC-410W, C1 Pro, C2 Pro, RLC-422W, and RLC-511W devices through 1.0.227, an authenticated admin can use the "TestEmail" functionality to inject and…
Product not named
ExploitedHigh7.2 - CVE-2024-55956
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or…
Product not named
ExploitedCritical9.8 - CVE-2024-35250
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1507
ExploitedHigh7.8 - CVE-2024-20767
ColdFusion | Improper Access Control (CWE-284)
Adobe · ColdFusion
ExploitedHigh7.4
Most severe new CVEsBy CVSS score
- CVE-2023-4617
Gaining remote control over Govee devices
Govee · Govee Home
Critical10.0 - CVE-2024-47038
In dhd_prot_flowrings_pool_release of dhd_msgbuf.c, there is a possible outcof bounds write due to a missing bounds check. This could lead to localcescalation…
Google · Android
Critical10.0 - CVE-2024-47039
OOB Read in the android.hardware.boot.IBootControl/default service
Google · Android
Critical10.0 - CVE-2024-47040
Use After Free in the android.hardware.radio.sap.ISap/slot2 service
Google · Android
Critical10.0 - CVE-2024-56050
WordPress WPLMS plugin < 1.9.9.5.3 - Subscriber+ Arbitrary File Upload vulnerability
VibeThemes · WPLMS
Critical9.9 - CVE-2024-56052
WordPress WPLMS plugin < 1.9.9.5.2 - Student+ Arbitrary File Upload vulnerability
VibeThemes · WPLMS
Critical9.9 - CVE-2024-54370
WordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.0 - Arbitrary File Upload vulnerability
SuitePlugins · Video & Photo Gallery for Ultimate Member
Critical9.9 - CVE-2024-56057
WordPress WPLMS plugin < 1.9.9.5.2 - Arbitrary File Upload vulnerability
VibeThemes · WPLMS
Critical9.9 - CVE-2024-12356
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
BeyondTrust · Remote Support
ExploitedCritical9.8 - CVE-2024-50379
Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
Apache Software Foundation · Apache Tomcat
Critical9.8