Vulnerability report: June 2024
June 2024 vulnerability report: a selection of CVEs with the most critical CVSSv3 scores (9 and 10), the affected products and the CERT-FR advisories to know.
Why this selection?
We selected the highest CVSSv3 scores (9 & 10).
Our aim:
- To raise your awareness of the importance of this news.
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores.
- To tell you the type of vulnerability.
- To provide the CVE identifier and the CERT-FR advisory reference.
News bulletin from 23 May to 23 June 2024
| CVSSv3 score | Product | Vendor | CVE identifier | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 9.9 | Kibana (Google Chrome) | Elastic | CVE-2024-2887 | Remote arbitrary code execution | CERTFR-2024-AVI-0500 |
| 9.8 | PHP | PHP | CVE-2024-4577 | Remote arbitrary code execution | CERTFR-2024-AVI-0468 |
| 9.8 | Windows, Windows Server | Microsoft | CVE-2024-30080 | Remote arbitrary code execution | CERTFR-2024-AVI-0486 |
| 9.8 | Commerce, Magento Open Source , Commerce Webhooks Plugin | Adobe | CVE-2024-34102 | Remote arbitrary code execution | CERTFR-2024-AVI-0483 |
| 9.8 | Sage 1410, Sage 1430, Sage 1450, Sage 2400, Sage 3030, Sage 4400 | Schneider Electric | CVE-2021-37036 | Security policy bypass | CERTFR-2024-AVI-0476 |
| 9.8 | PowerSys | Siemens | CVE-2024-36266 | Security policy bypass | CERTFR-2024-AVI-0478 |
| 9.0 | Recovery Orchestrator | Veeam | CVE-2024-29855 | Security policy bypass | CERTFR-2024-AVI-0474 |
| 9.8 | VMWare vCenter Server | Broadcom | CVE-2024-37079 -> CVE-2024-37080 | Remote arbitrary code execution | CERTFR-2024-AVI-0502 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.