March 2024
3,374 CVEs published, +13% on February 2024. CISA added 10 to KEV.
2024 month by month
- Critical
- 2818% of the 3,314 with a CVSS score
- Added to CISA KEV
- 108 of this month's CVEs are in KEV, listed a median 53 days after publication
- Vendors
- 1,5455,162 products
- Top weakness
- XSSCWE-79 · 795 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1Сообщество Свободного Программного ОбеспеченияLinux, Debian Gnu/linux, Phpmyfaq3336nonenew
- 2LinuxLinux, Linux Kernel2350nonenew
- 3Ооо «ред Софт»Ред Ос1782nonenew
- 4Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition1402nonenew
- 5TendaFH1202 Firmware, AC18 Firmware, FH1205 Firmware13516nonenew
- 6Ао "нппкт"Осон Основа Оnyx1073nonenew
- 7GoogleAndroid, Google Chrome, Chrome924nonenew
- 8ApplemacOS, iPhone OS, iOS and iPadOS9102new
- 9CanonicalUbuntu902nonenew
- 10Shenzhen Tenda Technology Co., Ltd.Tenda AC15, Tenda AC7, Tenda AC10U828nonenew
- 11MicrosoftWindows 11 23h2, Windows 11 22h2, Windows Server 2022 (Server Core Installation)7322new
- 12Red HatRed Hat Enterprise Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9682nonenew
- 13MavenOrg.geoserver:gs-restconfig, Org.jenkins-ci.plugins:htmlpublisher, Org.open-metadata:openmetadata-service676nonenew
- 14IBMSecure Proxy, Sterling Secure Proxy, DS8900F630nonenew
- 15SourcecodesterEmployee Task Management System, Online Mobile Management Store, Petrol Pump Management Software590nonenew
- 16Oretnom23Customer Support System, Employee Task Management System, Online Mobile Store Management System582nonenew
- 17AdobeAdobe Experience Manager, Experience Manager, Bridge5601new
- 18CampcodesOnline Job Finder System, Online Marriage Registration System, Complete Online Dj Booking System550nonenew
- 19GoGithub.com/argoproj/argo-cd/v2, Github.com/zitadel/zitadel, Github.com/cilium/cilium536nonenew
- 20PyPIGradio, Paddlepaddle, Apache-airflow486nonenew
- 21DebianDebian Linux470nonenew
- 22PackagistPhpmyfaq/phpmyfaq, Getgrav/grav, Friendsofsymfony1/symfony1471nonenew
- 23npmDirectus, Katex, Rsshub437nonenew
- 24FedoraprojectFedora411nonenew
- 25Ао «нтц Ит Роса»Rosa Virtualization 3.0, Роса Хром, Rosa Virtualization411nonenew
Severity
How this month's CVEs score on CVSS; 60 have no score yet. Severity is not exploitation.
- Critical281
- High1,118
- Medium1,768
- Low147
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-79XSS795
- CWE-89SQL Injection258
- CWE-787Out-of-bounds Write165
- CWE-121145
- CWE-352CSRF140
- CWE-862Missing Authorization112
- CWE-125Out-of-bounds Read74
- CWE-434Unrestricted File Upload74
- CWE-200Information Exposure71
- CWE-416Use After Free68
- CWE-476NULL Pointer Dereference64
- CWE-22Path Traversal60
- CWE-20Improper Input Validation57
- CWE-284Improper Access Control48
- CWE-269Improper Privilege Mgmt45
- CWE-78OS Command Injection44
- CWE-502Deserialization41
- CWE-120Buffer Overflow40
- CWE-94Code Injection39
- CWE-400Resource Consumption35
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Web & CMS Plugins1,11927% of sector-tagged CVEs
- Operating Systems59214% of sector-tagged CVEs
- Enterprise Software45311% of sector-tagged CVEs
- OSS Libraries44711% of sector-tagged CVEs
- Networking Infrastructure2997% of sector-tagged CVEs
- Mobile Apps2025% of sector-tagged CVEs
- 9 smaller sectors773
- Not yet classified281
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 79XSS | 89SQL Injection | 787Out-of-bounds Write | 121 | 352CSRF | 862Missing Authorization | 125Out-of-bounds Read | 434Unrestricted File Upload | 200Information Exposure | 416Use After Free |
|---|---|---|---|---|---|---|---|---|---|---|
| Сообщество Свободного Программного Обеспечения | 8 | 5 | 16 | 15 | 1 | 1 | 32 | |||
| Linux | 11 | 14 | 28 | |||||||
| Ооо «ред Софт» | 2 | 6 | 1 | 10 | 22 | |||||
| Ооо «русбитех-астра» | 9 | 9 | 20 | |||||||
| Tenda | 59 | 108 | 4 | 5 | ||||||
| Ао «нппкт» | 1 | 6 | 4 | 12 | ||||||
| Apple | 6 | 2 | 2 | 4 | 3 | |||||
| Canonical Ltd. | 6 | 9 | 12 | |||||||
| 1 | 26 | 2 | 20 | 9 | ||||||
| Shenzhen Tenda Technology Co., Ltd. | 35 | 64 | 4 | 3 | ||||||
| Microsoft Corp | 1 | 3 | 2 | 1 | 8 | |||||
| Microsoft | 1 | 1 | 2 | 1 | 7 |
CVEs published in March 2024
44 vulnerabilities from this month that were exploited in the wild (CISA KEV), covered in the news, explained on cve.tools or searched for. Known-exploited first, then by CVSS.
- CVE-2023-48788A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2.2, FortiClientEMS 7.0.1 through 7.0.10 allows attacker to...KEV9.8
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleKEV9.8
- CVE-2024-23225A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Vent...KEV7.8
- CVE-2024-23296A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.4 and iPadOS 17.4, macOS Monterey 12.7.6, macOS Sonoma 14.4, macOS Vent...KEV7.8
- CVE-2024-26169Windows Error Reporting Service Elevation of Privilege VulnerabilityKEV7.8
- CVE-2024-29059.NET Framework Information Disclosure VulnerabilityKEV7.5
- CVE-2024-20767ColdFusion | Improper Access Control (CWE-284)KEV7.4
- CVE-2024-27199In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possibleKEV7.3
- CVE-2024-3094Xz: malicious code in distributed source10.0
- CVE-2024-29135WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability9.9
- CVE-2024-30500WordPress CubeWP plugin <= 1.1.12 - Arbitrary File Upload vulnerability9.9
- CVE-2024-25735An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.9.1
- CVE-2024-26580Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability9.1
- CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job name9.0
- CVE-2024-24725Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessmen...8.8
- CVE-2024-25228Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.8.8
- CVE-2024-28116Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass8.8
- CVE-2024-30244WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerability8.5
- CVE-2024-27204In tmu_set_gov_active of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges neede...8.4
- CVE-2024-27758In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(client_netref)), a remote attacker can craft a class that ...8.4
- CVE-2024-28088LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chain call. This bypasses the intended behavior of loading ...8.1
- CVE-2023-6175Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark7.8
- CVE-2024-30245WordPress DecaLog plugin <= 3.9.0 - SQL Injection vulnerability7.6
- CVE-2024-25599WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-29137WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-30194WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-30199WordPress WP-Lister Lite for Amazon plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1
- CVE-2024-2206SSRF Vulnerability in gradio-app/gradio6.5
- CVE-2024-2416Cross-Site Request Forgery vulnerability in Movistar 4G router6.5
- CVE-2024-30182WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-30197WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability6.5
- CVE-2024-1234Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4
- CVE-2024-1391Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Thumbnail Slider Widget6.4
- CVE-2024-29644Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script to the user login box.6.1
- CVE-2024-29921WordPress Photo Gallery by Supsystic plugin <= 1.15.16 - Cross Site Scripting (XSS) vulnerability5.9
- CVE-2024-1853Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination5.5
- CVE-2024-22513djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing...5.5
- CVE-2024-27950WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerability5.4
- CVE-2024-29032`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code5.3
- CVE-2024-31138In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings4.6
- CVE-2024-28180Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)4.3
- CVE-2024-30493WordPress Church Admin plugin <= 4.1.7 - Cross Site Request Forgery (CSRF) vulnerability4.3
- CVE-2024-23823CORS settings overly permissive in vantage64.2
- CVE-2024-28868Umbraco possible user enumeration vulnerability3.7