Week 52, 2024
23 December to 29 December 2024. The CVEs published in the week, the most severe of them, and what CISA added to its catalog of known exploited vulnerabilities.
- 584CVEs publishedin the whole week
- 29CriticalCVSS 9.0 and above
- 184HighCVSS 7.0 to 8.9
- 1Added to KEVknown exploited, newly listed
Added to KEVAttackers use these now; patch them first
- CVE-2021-44207
Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials.
Product not named
ExploitedHigh8.1
Most severe new CVEsBy CVSS score
- CVE-2024-52046
Apache MINA: MINA applications using unbounded deserialization may allow RCE
Apache Software Foundation · Apache MINA
Critical10.0 - CVE-2024-56719
net: stmmac: fix TSO DMA API usage causing oops
Linux · Linux
Critical10.0 - CVE-2024-45387
Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
Apache Software Foundation · Apache Traffic Control
Critical9.9 - CVE-2024-8950
SQLi in Arne Informatics' Piramit Automation
Arne Informatics · Piramit Automation
Critical9.9 - CVE-2024-43441
Apache HugeGraph-Server: Fixed JWT Token(Secret)
Apache Software Foundation · Apache HugeGraph-Server
Critical9.8 - CVE-2024-56431
oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 7180717 has an invalid negative left shift. NOTE: this is disputed by third parties because…
Product not named
Critical9.8 - CVE-2024-11281
WooCommerce Point of Sale <= 6.1.0 - Insecure Direct Object Reference to Privilege Escalation via Arbitrary User Email Change
Webkul · WooCommerce Point of Sale
Critical9.8 - CVE-2024-50944
Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in…
Product not named
Critical9.8 - CVE-2024-50717
SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client parameter in the /recuperaLog.php…
Product not named
Critical9.8 - CVE-2024-50716
SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id parameter in the /sendPushManually.php…
Product not named
Critical9.8