Exploited vulnerabilities (CISA KEV)

CVE-2024-1212 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-78 Feb 21, 2024

Progress Kemp LoadMaster OS Command Injection Vulnerability

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVE-2024-1709 Critical · 10.0 KEV Urgent · 100 Public exploit Ransomware CWE-288 Feb 21, 2024

ConnectWise ScreenConnect Authentication Bypass Vulnerability

ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

CVE-2024-1708 High · 8.4 KEV Urgent · 86 Public exploit Ransomware CWE-22 Feb 21, 2024

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.

CVE-2024-20953 High · 8.8 KEV High · 55 CWE-502 Feb 16, 2024

Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in takeover of Oracle Agile PLM. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2024-23113 Critical · 9.8 KEV High · 69 Public exploit CWE-134 Feb 15, 2024

Fortinet Multiple Products Format String Vulnerability

A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14, FortiPAM versions 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3, FortiSwitchManager versions 7.2.0 through 7.2.3, 7.0.0 through 7.0.3 allows attacker to execute unauthorized code or commands via specially crafted packets.

CVE-2024-21413 Critical · 9.8 KEV High · 69 Public exploit CWE-20 Feb 13, 2024

Microsoft Outlook Improper Input Validation Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

CVE-2024-21412 High · 8.1 KEV Urgent · 72 Public exploit Ransomware CWE-693 Feb 13, 2024

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2024-21410 Critical · 9.8 KEV High · 68 Public exploit CWE-287 Feb 13, 2024

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2024-21351 High · 7.6 KEV High · 56 CWE-94 Feb 13, 2024

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2024-21338 High · 7.8 KEV Urgent · 80 Public exploit Ransomware CWE-822 Feb 13, 2024

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-21762 Critical · 9.8 KEV Urgent · 79 Public exploit Ransomware CWE-787 Feb 9, 2024

Fortinet FortiOS Out-of-Bound Write Vulnerability

A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted requests