Vulnerability report: February 2024
Vulnerability report February 2024: CVEs with CVSSv3 scores between 9 and 10, the products affected and CERT-FR advisories to help protect your systems.
Why this selection?
We have selected the CVSSv3 scores between 9 and 10.
Our aim:
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores**.**
- To tell you the type of vulnerability**.**
- To provide the CVE identifier and the CERT-FR advisory reference.
- To raise your awareness of the importance of this news.
News bulletin from 22 January to 25 February 2024
| CVSSv3 score | Product | Vendor | CVE ID | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 10 | PostgreSQL | JDBC | CVE-2024-1597 | Remote arbitrary code execution | CERTFR-2024-AVI-0040 |
| 10 | Fortinet | FortiSIEM | CVE-2024-23109 & CVE-2024-23108 | Remote arbitrary code execution | CERTFR-2024-AVI-0106 |
| 9.9 | Cisco | Unified Communications | CVE-2024-20253 | Remote arbitrary code execution | CERTFR-2024-AVI-0068 |
| 9.9 | Gitlab | Gitlab CE/EE | CVE-2024-0402 | Security policy bypass | CERTFR-2024-AVI-0069 |
| 9.8 | Microsoft | Outlook | CVE-2024-21413 | Remote arbitrary code execution | CERTFR-2024-AVI-0127 |
| 9.8 | Microsoft | Exchange Server | CVE-2024-21410 | Remote arbitrary code execution | CERTFR-2024-AVI-0131 |
| 9.8 | Fortinet | FortiOS | CVE-2024-23113 | Remote arbitrary code execution | CERTFR-2024-AVI-0108 |
| 9.6 | Fortinet | FortiOS SSL VPN | CVE-2024-21762 | Privilege escalation | CERTFR-2024-AVI-0108 |
| 9.6 | Liferay | Liferay DXP, Liferay Portal | CVE-2024-25145 | Security policy bypass | CERTFR-2024-AVI-0141 |
| 9.6 | Cisco | Expressway | CVE-2024-20252 & CVE-2024-20254 & CVE-2024-20255 | CSRF | CERTFR-2024-AVI-0103 |
| 9.1 | Adobe | Adobe Commerce, Magento Open Source | CVE-2024-20719 | XSS, undefined | CERTFR-2024-AVI-0123 |
| 9.1 | Adobe | Adobe Commerce, Magento Open Source | CVE-2024-20720 | Privilege escalation | CERTFR-2024-AVI-0018 |
| 9.1 | SAP | SAP ABA (Application Basis) | CVE-2024-20720 | Remote arbitrary code execution | CERTFR-2024-AVI-0123 |
| 9.8 & 9.1 | IBM | Sterling Control Center (Apache Axis & QRadar SIEM (lapack) | CVE-2023-40743 & CVE-2021-4048 | Remote arbitrary code execution & Remote denial of service | CERTFR-2024-AVI-0090 |
| 9.1 | Juniper | Secure Analytics (lapack) | CVE-2021-4048 | Remote denial of service | CERTFR-2024-AVI-0086 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.