Vulnerability report: April 2024
April 2024 vulnerability report: a selection of CVEs with CVSSv3 scores between 9 and 10, the affected products and the CERT-FR advisories to patch first.
Why this selection?
We selected CVSSv3 scores between 9 and 10.
Our aim:
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores.
- To tell you the type of vulnerability.
- To provide the CVE identifier and the CERT-FR advisory reference.
- To raise your awareness of the importance of this news.
News bulletin from 27 March to 21 April 2024
| CVSSv3 score | Product | Vendor | CVE identifier | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 9.9 | Synology | Surveillance Station | CVE-2024-29241 | Security policy bypass | CERTFR-2024-AVI-0266 |
| 9.8 | GlobalProtect | Palo Alto Networks | CVE-2024-3400 | Remote arbitrary code execution | CERTFR-2024-AVI-0307 |
| 9.8 | Avalanche | Ivanti | CVE-2024-29204 | Remote arbitrary code execution | CERTFR-2024-AVI-0314 |
| 9.8 | Avalanche | Ivanti | CVE-2024-24996 | Remote arbitrary code execution | CERTFR-2024-AVI-0314 |
| 9.8 | Qradar Analyst Workflow | IBM | CVE-2023-42282 | Remote arbitrary code execution | CERTFR-2024-AVI-0330 |
| 9.8 | Oracle StorageTek Tape Analytics | Oracle | CVE-2022-34381 & CVE-2020-35168 | Remote arbitrary code execution | CERTFR-2024-AVI-0208 |
| 9.8 | WebLogic Server, PeopleSoft Enterprise HCM Global Payroll, Oracle Solaris Cluster, Oracle StorageTek Tape Analytics | Oracle | CVE-2022-42920 | Remote arbitrary code execution | CERTFR-2024-AVI-0324 |
| 9.8 | PeopleSoft Enterprise PeopleTools | Oracle | CVE-2023-38545 | Unspecified by the vendor | CERTFR-2024-AVI-0325 |
| 9.8 | Oracle WebLogic Server | Oracle | CVE-2021-23369 | Remote arbitrary code execution | CERTFR-2024-AVI-0201 |
| 9.4 | FortiClientLinux | Fortinet | CVE-2023-45590 | Remote arbitrary code execution | CERTFR-2024-AVI-0287 |
| 9.1 | PHP | CVE-2024-1874 | Remote arbitrary code execution | CERTFR-2024-AVI-0300 | |
| 9.0 | Adobe Commerce, Magento Open Source | Adobe | CVE-2024-20758 | Security policy bypass | CERTFR-2024-AVI-0284 |
| 9.0 | Azure Kubernetes Service Confidential Containers (AKSCC) | Microsoft | CVE-2024-29990 | Privilege escalation | CERTFR-2024-AVI-0291 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.