Do Son CVE-2024-20360, carries a CVSS score of 8.8, signifying a high severity level and the potential for widespread exploitation.
Vulnerability
Sonatype has issued an urgent security advisory regarding a critical vulnerability (CVE-2024-4956) in Nexus Repository
CVE-2024-36080 and CVE-2024-36081, pose significant risks to affected systems and necessitate immediate attention and action
The severity of CVE-2024-29269 is further highlighted by the recent publication of a proof-of-concept (PoC) by security researcher Chocapikk.
The most severe vulnerability, CVE-2024-4835 (CVSS 8.0), involves a cross-site scripting (XSS) flaw in the code editor on gitlab.com
The vulnerability (CVE-2024-33899 for Linux/Unix, CVE-2024-36052 for Windows) poses a greater threat on Linux and Unix
The CVE-2024-31989 vulnerability affects anyone who does not have strict access controls on their Redis instance
CVE-2024-21683 allow attackers to seize control of affected systems, potentially leading to data breaches and operational disruptions
CVE-2024-22273 affects VMware ESXi, Workstation, and Fusion—foundational tools for virtual machine creation and management
The ability for unauthenticated attackers to execute arbitrary code (CVE-2024-29822 through CVE-2024-29827) could lead to complete system takeover
The impact can be significant, particularly for flaws CVE-2024-29849 and CVE-2024-29850, which allow unauthorized access and account takeover
Horizon3.ai published the technical details and a proof-of-concept (PoC) for a critical unauthenticated RCE vulnerability (CVE-2023-34992)
Codean Labs published the technical details and a proof-of-concept (PoC) exploit code for a high-severity CVE-2024-4367 vulnerability
GitHub has disclosed a critical security vulnerability (CVE-2024-4985) in its self-hosted GitHub Enterprise Server (GHES) product
A critical memory corruption vulnerability, dubbed Linguistic Lumberjack (CVE-2024-4323), has been uncovered in Fluent Bit
The first vulnerability, tracked as CVE-2023-43208 (CVSS 9.8), affects NextGen Healthcare's Mirth Connect.
CVE-2024-4709, CVE-2024-2771, and CVE-2024-2782, range from cross-site scripting (XSS) to unauthorized access and privilege escalation
CVE-2024-34359 allow attackers to execute arbitrary code on systems using the library, leading to data breaches and system compromise
CVE-2024-3368 enables attackers to inject malicious code into websites, potentially leading to unauthorized access, data theft
A proof-of-concept (PoC) exploit code for a recently patched zero-day CVE-2024-4947 vulnerability in Google Chrome has surfaced
In addition to the technical details, Murali crafted a proof-of-concept (PoC) exploit for CVE-2024-32002 to demonstrate the RCE.
Tracked as CVE-2024-34082 (CVSS 8.5), the vulnerability stems from Grav's use of the Twig templating engine.