CISA Known Exploited Vulnerabilities Catalog
9.8
CVE-2024-47575 - Fortinet FortiManager Missing Authentication Vulnerability -
Action Due Nov 13, 2024 Target Vendor : Fortinet
Description : Fortinet FortiManager contains a missing authentication vulnerability in the fgfmd daemon that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://fortiguard.fortinet.com/psirt/FG-IR-24-423 ; https://nvd.nist.gov/vuln/detail/CVE-2024-47575
7.2
CVE-2024-38094 - Microsoft SharePoint Deserialization Vulnerability -
Action Due Nov 12, 2024 Target Vendor : Microsoft
Description : Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38094 ; https://nvd.nist.gov/vuln/detail/CVE-2024-38094
9.8
CVE-2024-9537 - ScienceLogic SL1 Unspecified Vulnerability -
Action Due Nov 11, 2024 Target Vendor : ScienceLogic
Description : ScienceLogic SL1 (formerly EM7) is affected by an unspecified vulnerability involving an unspecified third-party component.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://support.sciencelogic.com/s/article/15527 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9537
9.8
CVE-2024-40711 - Veeam Backup and Replication Deserialization Vulnerability -
Action Due Nov 07, 2024 Target Vendor : Veeam
Description : Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Known
Notes : https://www.veeam.com/kb4649 ; https://nvd.nist.gov/vuln/detail/CVE-2024-40711
7.0
CVE-2024-30088 - Microsoft Windows Kernel TOCTOU Race Condition Vulnerability -
Action Due Nov 05, 2024 Target Vendor : Microsoft
Description : Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-30088 ; https://nvd.nist.gov/vuln/detail/CVE-2024-30088
9.8
CVE-2024-9680 - Mozilla Firefox Use-After-Free Vulnerability -
Action Due Nov 05, 2024 Target Vendor : Mozilla
Description : Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.mozilla.org/en-US/security/advisories/mfsa2024-51/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-9680
9.1
CVE-2024-28987 - SolarWinds Web Help Desk Hardcoded Credential Vulnerability -
Action Due Nov 05, 2024 Target Vendor : SolarWinds
Description : SolarWinds Web Help Desk contains a hardcoded credential vulnerability that could allow a remote, unauthenticated user to access internal functionality and modify data.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.solarwinds.com/trust-center/security-advisories/cve-2024-28987 ; https://nvd.nist.gov/vuln/detail/CVE-2024-28987
9.8
CVE-2024-23113 - Fortinet Multiple Products Format String Vulnerability -
Action Due Oct 30, 2024 Target Vendor : Fortinet
Description : Fortinet FortiOS, FortiPAM, FortiProxy, and FortiWeb contain a format string vulnerability that allows a remote, unauthenticated attacker to execute arbitrary code or commands via specially crafted requests.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.fortiguard.com/psirt/FG-IR-24-029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-23113
7.2
CVE-2024-9379 - Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability -
Action Due Oct 30, 2024 Target Vendor : Ivanti
Description : Ivanti Cloud Services Appliance (CSA) contains a SQL injection vulnerability in the admin web console in versions prior to 5.0.2, which can allow a remote attacker authenticated as administrator to run arbitrary SQL statements.
Action : As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9379
7.2
CVE-2024-9380 - Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability -
Action Due Oct 30, 2024 Target Vendor : Ivanti
Description : Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS.
Action : As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-CSA-Cloud-Services-Appliance-CVE-2024-9379-CVE-2024-9380-CVE-2024-9381 ; https://nvd.nist.gov/vuln/detail/CVE-2024-9380
7.8
CVE-2024-43047 - Qualcomm Multiple Chipsets Use-After-Free Vulnerability -
Action Due Oct 29, 2024 Target Vendor : Qualcomm
Description : Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory.
Action : Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://git.codelinaro.org/clo/la/platform/vendor/qcom/opensource/dsp-kernel/-/commit/0e27b6c7d2bd8d0453e4465ac2ca49a8f8c440e2 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43047
7.8
CVE-2024-43572 - Microsoft Windows Management Console Remote Code Execution Vulnerability -
Action Due Oct 29, 2024 Target Vendor : Microsoft
Description : Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/advisory/CVE-2024-43572 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43572
8.1
CVE-2024-43573 - Microsoft Windows MSHTML Platform Spoofing Vulnerability -
Action Due Oct 29, 2024 Target Vendor : Microsoft
Description : Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43573
10.0
CVE-2024-45519 - Synacor Zimbra Collaboration Command Execution Vulnerability -
Action Due Oct 24, 2024 Target Vendor : Synacor
Description : Synacor Zimbra Collaboration contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2024-45519
8.8
CVE-2024-29824 - Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability -
Action Due Oct 23, 2024 Target Vendor : Ivanti
Description : Ivanti Endpoint Manager (EPM) contains a SQL injection vulnerability in Core server that allows an unauthenticated attacker within the same network to execute arbitrary code.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://forums.ivanti.com/s/article/Security-Advisory-May-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-29824
9.8
CVE-2023-25280 - D-Link DIR-820 Router OS Command Injection Vulnerability -
Action Due Oct 21, 2024 Target Vendor : D-Link
Description : D-Link DIR-820 routers contain an OS command injection vulnerability that allows a remote, unauthenticated attacker to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.
Action : The impacted product is end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue utilization of the product.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10358 ; https://nvd.nist.gov/vuln/detail/CVE-2023-25280
9.8
CVE-2020-15415 - DrayTek Multiple Vigor Routers OS Command Injection Vulnerability -
Action Due Oct 21, 2024 Target Vendor : DrayTek
Description : DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://www.draytek.com/about/security-advisory/vigor3900-/-vigor2960-/-vigor300b-remote-code-injection/execution-vulnerability-(cve-2020-14472) ; https://nvd.nist.gov/vuln/detail/CVE-2020-15415
5.5
CVE-2021-4043 - Motion Spell GPAC Null Pointer Dereference Vulnerability -
Action Due Oct 21, 2024 Target Vendor : Motion Spell
Description : Motion Spell GPAC contains a null pointer dereference vulnerability that could allow a local attacker to cause a denial-of-service (DoS) condition.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. For more information, please see: https://github.com/gpac/gpac/commit/64a2e1b799352ac7d7aad1989bc06e7b0f2b01db ; https://nvd.nist.gov/vuln/detail/CVE-2021-4043
9.8
CVE-2019-0344 - SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability -
Action Due Oct 21, 2024 Target Vendor : SAP
Description : SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://web.archive.org/web/20191214053020/https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017 ; https://nvd.nist.gov/vuln/detail/CVE-2019-0344
9.8
CVE-2024-7593 - Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability -
Action Due Oct 15, 2024 Target Vendor : Ivanti
Description : Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
Action : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known To Be Used in Ransomware Campaigns? : Unknown
Notes : https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 ; https://nvd.nist.gov/vuln/detail/CVE-2024-7593