February 2024
2,983 CVEs published, +11% on January 2024 and +16% on February 2023. CISA added 9 to KEV.
2024 month by month
- Critical
- 32211% of the 2,802 with a CVSS score
- Added to CISA KEV
- 911 of this month's CVEs are in KEV, listed a median 20 days after publication
- Vendors
- 1,4124,886 products
- Top weakness
- XSSCWE-79 · 438 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Envoy40510nonenew
- 2LinuxLinux Kernel, Linux2990nonenew
- 3Ооо «ред Софт»Ред Ос2054nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition1833nonenew
- 5Ао "нппкт"Осон Основа Оnyx964nonenew
- 6Ао «ивк»Альт Сп 10, Альт 8 Сп920nonenew
- 7MicrosoftWindows Server 2022, 23h2 Edition (Server Core Installation), Windows 11 23h2, Windows 11 22h29095new
- 8MavenCom.liferay.portal:release.portal.bom, Com.liferay.portal:release.dxp.bom, Org.apache.dolphinscheduler:dolphinscheduler8920nonenew
- 9IBMPowersc, Security Verify Access Appliance, Security Verify Access Docker862nonenew
- 10Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 7, Enterprise Linux793nonenew
- 11CanonicalUbuntu, Lxd, Ubuntu Edk Ii760nonenew
- 12IntelThunderbolt Dch Driver, Intel Proset/wireless Wifi, Intel Killer Wi-fi760nonenew
- 13Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Хром, Роса Кобальт711nonenew
- 14FedoraprojectFedora, Unbound6911nonenew
- 15GoogleAndroid, Google Chrome, Chrome694nonenew
- 16PyPIVyper, Apache-superset, Clearml6612nonenew
- 17PackagistMoodle/moodle, Getkirby/cms, Typo3/cms-core646nonenew
- 18GoGithub.com/mattermost/mattermost/server/v8, Github.com/greenpau/caddy-security, Github.com/apache/incubator-answer522nonenew
- 19DellUnity, Unity Operating Environment, Supportassist For Home Pcs475nonenew
- 20OracleMySQL Server, E-business Suite, Graalvm Enterprise Edition4701new
- 21ApacheSuperset, Dolphinscheduler, Solr4111nonenew
- 22Apache Software FoundationApache Superset, Apache Dolphinscheduler, Apache Solr388nonenew
- 23LiferayDigital Experience Platform, Liferay Portal, Dxp3513nonenew
- 24Fedora ProjectFedora343nonenew
- 25DebianDebian Linux332nonenew
Severity
How this month's CVEs score on CVSS; 181 have no score yet. Severity is not exploitation.
- Critical322
- High892
- Medium1,462
- Low126
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS438
- CWE-89SQL Injection173
- CWE-787Out-of-bounds Write128
- CWE-352CSRF124
- CWE-284Improper Access Control98
- CWE-416Use After Free92
- CWE-476NULL Pointer Dereference90
- CWE-862Missing Authorization81
- CWE-22Path Traversal76
- CWE-125Out-of-bounds Read74
- CWE-434Unrestricted File Upload67
- CWE-78OS Command Injection61
- CWE-20Improper Input Validation58
- CWE-400Resource Consumption57
- CWE-200Information Exposure56
- CWE-94Code Injection53
- CWE-122Heap Buffer Overflow45
- CWE-40144
- CWE-77Command Injection43
- CWE-120Buffer Overflow34
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins74320% of sector-tagged CVEs
- Operating Systems70319% of sector-tagged CVEs
- OSS Libraries49413% of sector-tagged CVEs
- Enterprise Software44912% of sector-tagged CVEs
- Hardware Firmware2487% of sector-tagged CVEs
- Networking Infrastructure1534% of sector-tagged CVEs
- 9 smaller sectors783
- Not yet classified189
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 352CSRF | 284Improper Access Control | 416Use After Free | 476NULL Pointer Dereference | 862Missing Authorization | 22Path Traversal | 125Out-of-bounds Read |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 2 | 21 | 1 | 1 | 52 | 62 | 2 | 19 | ||
| Linux | 9 | 44 | 58 | 15 | ||||||
| Ооо «ред Софт» | 2 | 1 | 13 | 1 | 25 | 31 | 1 | 8 | ||
| Ооо «русбитех-астра» | 2 | 15 | 1 | 26 | 25 | 8 | ||||
| Ао «нппкт» | 1 | 1 | 8 | 1 | 9 | 5 | 4 | |||
| Ао «ивк» | 1 | 6 | 9 | 15 | 6 | |||||
| Maven | 16 | 3 | 1 | 3 | 1 | 3 | ||||
| Microsoft Corp | 8 | 1 | 1 | 5 | 7 | 3 | 3 | |||
| IBM | 8 | 1 | 1 | 2 | 1 | 2 | ||||
| Microsoft | 8 | 2 | 4 | 5 | 2 | 2 | ||||
| Canonical Ltd. | 6 | 9 | 5 | 4 | ||||||
| Intel | 1 | 24 | 1 | 1 |
CVEs published in February 2024
42 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2024-1212LoadMaster Pre-Authenticated OS Command InjectionKEV10.0
- CVE-2024-1709Authentication bypass using an alternate path or channelKEV10.0
- CVE-2024-21410Microsoft Exchange Server Elevation of Privilege VulnerabilityKEV9.8
- CVE-2024-21413Microsoft Outlook Remote Code Execution VulnerabilityKEV9.8
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, F...KEV9.8
- CVE-2024-23113A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FortiProxy versions 7.4.0 through 7.4.2, 7.2.0 through 7.2....KEV9.8
- CVE-2024-20953Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged a...KEV8.8
- CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”)KEV8.4
- CVE-2024-21412Internet Shortcut Files Security Feature Bypass VulnerabilityKEV8.1
- CVE-2024-21338Windows Kernel Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-21351Windows SmartScreen Security Feature Bypass VulnerabilityKEV7.6
- CVE-2024-24594A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attacker to execute a JavaScript payload when a user views ...9.9
- CVE-2024-22902Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.9.8
- CVE-2024-23759Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.9.8
- CVE-2024-25140A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhanced Key Usage of Code Signing (1.3.6.1.5.5.7.3.3), valid ...9.8
- CVE-2024-25722qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.9.8
- CVE-2024-25830F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contain...9.8
- CVE-2024-24825TokenManager not checking permissions on cached tokens in DIRAC9.1
- CVE-2024-21915Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality9.0
- CVE-2024-25869An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings....8.8
- CVE-2024-0033In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges nee...7.8
- CVE-2024-25442An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a crafted image.7.8
- CVE-2024-23836crafted traffic can cause denial of service7.5
- CVE-2024-26134CBOR2 decoder has potential buffer overflow7.5
- CVE-2024-0428Index Now <= 2.6.3 - Cross-Site Request Forgery via reset_form7.1
- CVE-2024-24822Pimcore Admin Classic Bundle permissions are not getting checked when working with tags6.5
- CVE-2024-0255WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color6.4
- CVE-2024-1781Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection6.3
- CVE-2023-48432An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) withi...6.1
- CVE-2024-22927Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.6.1
- CVE-2024-24396Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the search bar component.6.1
- CVE-2024-27906Apache Airflow: Dag Code and Import Error Permissions Ignored5.9
- CVE-2024-1435WordPress Tainacan plugin <= 0.20.6 - Sensitive Data Exposure via Log File vulnerability5.3
- CVE-2024-24568Suricata http2: header handling evasion5.3
- CVE-2024-25126Rack ReDos in content type parsing (2nd degree polynomial)5.3
- CVE-2024-20972Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnera...4.9
- CVE-2024-22221 Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. An authenticated attacker could potentially exploit this vulnerability, leading to exposure of sensitive information. 4.5
- CVE-2024-27319Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.4.4
- CVE-2024-1402Denial of service in mattermost mobile apps and server via emoji reactions4.3
- CVE-2024-1953Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested from the API, allowing an authenticated attacker to cause ...4.3
- CVE-2024-24829SSRF in Sentry via Phabricator integration4.3
- CVE-2024-25931WordPress Heureka Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)4.3