Vulnerability report: January 2024
Vulnerability report January 2024: the CVEs with the highest CVSSv3 scores (9 and 10), the products and vendors affected and the related CERT-FR advisories.
Why this selection?
We have selected the highest CVSSv3 scores (9 & 10).
Our aim:
- To raise your awareness of the importance of this news.
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores**.**
- To tell you the type of vulnerability**.**
- To provide the CVE identifier and the CERT-FR advisory reference.
News bulletin from 27 December to 21 January 2024
| CVSSv3 score | Product | Vendor | CVE ID | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 10 | Siemens | SIMATIC IPC647E , SIMATIC IPC847E, SIMATIC IPC1047E | CVE-2023-51438 | Remote arbitrary code execution | CERTFR-2024-AVI-0014 |
| 10 | GitLab | Community Edition (CE) and Enterprise Edition (EE) | CVE-2023-5356 | Security policy bypass | CERTFR-2024-ALE-002 |
| 10 | Atlassian | Confluence | CVE-2023-22527 | Remote arbitrary code execution | CERTFR-2024-AVI-0040 |
| 9.9 | VMware | VMware Aria Automation | CVE-2023-34063 | Security policy bypass | CERTFR-2024-AVI-0037 |
| 9.8 | Juniper Networks | Juno OS | CVE-2024-21591 | Remote arbitrary code execution | CERTFR-2024-AVI-0027 |
| 9.8 | Juniper | Secure Analytics (SpringBlade) | CVE-2023-40787 | Remote arbitrary code execution | CERTFR-2023-AVI-1062 |
| 9.8 | NetApp | Active IQ Unified Manager | CVE-2019-3773 | Remote denial of service, Data integrity breach, Data confidentiality breach | CERTFR-2023-AVI-1060 |
| 9.8 | Ivanti | Endpoint Manager (EPM) | CVE-2023-39336 | Remote arbitrary code execution | CERTFR-2024-AVI-0008 |
| 9.8 | Siemens | SIMATIC CN 4100 | CVE-2023-49621 | Security policy bypass | CERTFR-2024-AVI-0014 |
| 9.6 | GitLab | Community Edition (CE) and Enterprise Edition (EE) | CVE-2023-5336 | Remote arbitrary code execution | CERTFR-2024-AVI-0030 |
| 9.1 | Ivanti | Connect Secure, Policy Secure Gateways, Ivanti Neurons for ZTA gateways | CVE-2024-21887 | Remote arbitrary code execution | CERTFR-2024-ALE-001 |
| 9.1 | SAP | Web IDE Full-Stack, Web IDE for SAP HANA, Edge Integration Cell, Business Technology Platform (BTP) Security Services Integration Libraries | CVE-2023-50422 / CVE-2023-50423 / CVE-2023-50424 / CVE-2023-49583 | Privilege escalation | CERTFR-2024-AVI-0018 |
| 9.1 | Microsoft | .NET | CVE-2024-0057 | Security policy bypass | CERTFR-2024-AVI-0024 |
| 8.2 | Microsoft | Windows, Windows Server | CVE-2024-20674 | Security policy bypass | CERTFR-2024-AVI-0021 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.