Vulnerability report: March 2024
Vulnerability report March 2024: the CVEs with CVSSv3 scores between 9 and 10, the vendors concerned and the CERT-FR advisories of the month to fix first.
Why this selection?
We have selected the CVSSv3 scores between 9 and 10.
Our aim:
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores**.**
- To tell you the type of vulnerability**.**
- To provide the CVE identifier and the CERT-FR advisory reference.
- To raise your awareness of the importance of this news.
News bulletin from 26 February to 24 March 2024
| CVSSv3 score | Product | Vendor | CVE ID | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 10 | Cerberus, Sinteso | Siemens | CVE-2024-22039 | Remote arbitrary code execution | CERTFR-2024-AVI-0203 |
| 9.9 | Ivanti Neurons for ITSM | Ivanti | CVE-2023-46808 | Data integrity breach | CERTFR-2024-AVI-0238 |
| 9.8 | ClearPass Policy Manager (Struts 2) | Aruba | CVE-2023-50164 | Remote arbitrary code execution | CERTFR-2024-AVI-0171 |
| 9.8 | CMG, InAttend | Mitel | CVE-2024-28815 | Remote arbitrary code execution, Security policy bypass | CERTFR-2024-AVI-0219 |
| 9.8 | FortiClientEMS | Fortinet | CVE-2023-48788 | Remote arbitrary code execution | CERTFR-2024-AVI-0212 |
| 9.8 | FortiOS, FortiProxy | Fortinet | CVE-2023-42789 | Remote arbitrary code execution | CERTFR-2024-AVI-0212 |
| 9.8 | OMI, SCOM | Microsoft | CVE-2024-21334 | Remote arbitrary code execution | CERTFR-2024-AVI-0208 |
| 9.8 | Azure Kubernetes Service Confidential Containers | Microsoft | CVE-2024-21400 | Privilege escalation | CERTFR-2024-AVI-0207 |
| 9.8 | Easergy T200 | Schneider Electric | CVE-2024-2051 | Security policy bypass | CERTFR-2024-AVI-0202 |
| 9.8 | QTS, QuTScloud | QNAP | CVE-2024-21899 | Remote arbitrary code execution | CERTFR-2024-AVI-0201 |
| 9.6 | Ivanti Standalone Sentry | Ivanti | CVE-2023-41724 | Remote arbitrary code execution | CERTFR-2024-AVI-0212 |
| 9.4 | Cognos Command Center (ActiveMQ) | IBM | CVE-2023-46604 | Remote arbitrary code execution | CERTFR-2024-AVI-0180/ |
| 9.3 | ESXi, Workstation, Fusion | VMware | CVE-2024-22252 & CVE-2024-22253 | Arbitrary code execution | CERTFR-2024-AVI-0186 |
| 9.1 | NetWeaver Administrator | SAP | CVE-2024-22127 | Remote arbitrary code execution | CERTFR-2024-AVI-0209 |
| 9.1 | Secure Analytics (ZooKeeper) | Jupiter | CVE-2023-44981 | Security policy bypass | CERTFR-2024-AVI-0173/ |
| 9.1 | QRadar SIEM (Apache Derby) | IBM | CVE-2022-46337 | Remote arbitrary code execution, Security policy bypass | CERTFR-2024-AVI-0228 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.