Exploited vulnerabilities (CISA KEV)

CVE-2024-40766 Critical · 9.8 KEV Urgent · 73 Ransomware CWE-284 Aug 23, 2024

SonicWall SonicOS Improper Access Control Vulnerability

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the firewall to crash. This issue affects SonicWall Firewall Gen 5 and Gen 6 devices, as well as Gen 7 devices running SonicOS 7.0.1-5035 and older versions.

CVE-2024-39717 High · 7.2 KEV High · 65 CWE-434 Aug 22, 2024

Versa Director Dangerous File Type Upload Vulnerability

The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in.

CVE-2024-28987 Critical · 9.1 KEV Urgent · 83 Public exploit CWE-798 Aug 21, 2024

SolarWinds Web Help Desk Hardcoded Credential Vulnerability

The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access internal functionality and modify data.

CVE-2024-7971 Critical · 9.6 KEV High · 66 Public exploit CWE-843 Aug 21, 2024

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-7965 High · 8.8 KEV High · 62 Public exploit CWE-787 Aug 21, 2024

Google Chromium V8 Inappropriate Implementation Vulnerability

Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2024-7262 High · 7.8 KEV High · 54 CWE-22 Aug 15, 2024

Kingsoft WPS Office Path Traversal Vulnerability

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.16412 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The vulnerability was found weaponized as a single-click exploit in the form of a deceptive spreadsheet document

CVE-2024-28986 Critical · 9.8 KEV High · 67 Public exploit CWE-502 Aug 13, 2024

SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability

SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. While it was reported as an unauthenticated vulnerability, SolarWinds has been unable to reproduce it without authentication after thorough testing. However, out of an abundance of caution, we recommend all Web Help Desk customers apply the patch, which is now available.

CVE-2024-7593 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-287 Aug 13, 2024

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

CVE-2024-38213 Medium · 6.5 KEV High · 52 CWE-693 Aug 13, 2024

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

CVE-2024-38193 High · 7.8 KEV Urgent · 70 Public exploit CWE-416 Aug 13, 2024

Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVE-2024-38189 High · 8.8 KEV High · 55 CWE-20 Aug 13, 2024

Microsoft Project Remote Code Execution Vulnerability

CVE-2024-38178 High · 7.5 KEV High · 56 CWE-843 Aug 13, 2024

Microsoft Windows Scripting Engine Memory Corruption Vulnerability

Scripting Engine Memory Corruption Vulnerability

CVE-2024-38106 High · 7.0 KEV High · 55 CWE-591 Aug 13, 2024

Microsoft Windows Kernel Privilege Escalation Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-38107 High · 7.8 KEV High · 52 CWE-416 Aug 13, 2024

Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability

Windows Power Dependency Coordinator Elevation of Privilege Vulnerability

CVE-2024-41710 High · 7.2 KEV High · 56 CWE-88 Aug 12, 2024

Mitel SIP Phones Argument Injection Vulnerability

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

CVE-2024-27443 Medium · 6.1 KEV High · 57 Public exploit CWE-79 Aug 12, 2024

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.

CVE-2024-7694 High · 7.2 KEV High · 53 CWE-434 Aug 12, 2024

TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability

ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

CVE-2024-7399 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-22 Aug 12, 2024

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.

CVE-2024-42009 Critical · 9.3 KEV Urgent · 70 Public exploit CWE-79 Aug 5, 2024

RoundCube Webmail Cross-Site Scripting Vulnerability

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

CVE-2024-38856 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-863 Aug 5, 2024

Apache OFBiz Incorrect Authorization Vulnerability

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met (such as when the screen definitions don't explicitly check user's permissions because they rely on the configuration of their endpoints).

CVE-2023-45249 Critical · 9.8 KEV Urgent · 79 Public exploit CWE-1393 Jul 24, 2024

Acronis Cyber Infrastructure (ACI) Insecure Default Password Vulnerability

Remote command execution due to use of default passwords. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 5.0.1-61, Acronis Cyber Infrastructure (ACI) before build 5.1.1-71, Acronis Cyber Infrastructure (ACI) before build 5.2.1-69, Acronis Cyber Infrastructure (ACI) before build 5.3.1-53, Acronis Cyber Infrastructure (ACI) before build 5.4.4-132.

CVE-2024-21182 High · 7.5 KEV High · 65 Public exploit Jul 16, 2024

Oracle WebLogic Server Unspecified Vulnerability

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

CVE-2024-5910 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-306 Jul 10, 2024

Palo Alto Networks Expedition Missing Authentication Vulnerability

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. Note: Expedition is a tool aiding in configuration migration, tuning, and enrichment. Configuration secrets, credentials, and other data imported into Expedition is at risk due to this issue.

CVE-2024-4879 Critical · 9.8 KEV Urgent · 81 Public exploit CWE-1287 Jul 10, 2024

ServiceNow Improper Input Validation Vulnerability

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted instances, and ServiceNow released the update to our partners and self-hosted customers. Listed below are the patches and hot fixes that address the vulnerability. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.

CVE-2024-5217 Critical · 9.8 KEV High · 67 Public exploit CWE-697 Jul 10, 2024

ServiceNow Incomplete List of Disallowed Inputs Vulnerability

ServiceNow has addressed an input validation vulnerability that was identified in the Washington DC, Vancouver, and earlier Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. The vulnerability is addressed in the listed patches and hot fixes below, which were released during the June 2024 patching cycle. If you have not done so already, we recommend applying security patches relevant to your instance as soon as possible.