Vulnerability report: May 2024
May 2024 vulnerability report: the CVEs with the highest CVSSv3 scores (9 and 10), the vendors concerned and the month's CERT-FR advisories for your clients.
Why this selection?
We selected the highest CVSSv3 scores (9 & 10).
Our aim:
- To present the most important vulnerability alerts of the past month.
- To give you the CVSSv3 scores.
- To tell you the type of vulnerability.
- To provide the CVE identifier and the CERT-FR advisory reference.
- To raise your awareness of the importance of this news.
News bulletin from 22 April to 21 May 2024
| CVSSv3 score | Product | Vendor | CVE identifier | Vulnerability type | CERT-FR advisory |
|---|---|---|---|---|---|
| 10 | SIMATIC CN 4100 | Siemens | CVE-2024-32740 | Arbitrary code execution | CERTFR-2024-AVI-0393 |
| 9.9 | Service Provider Console | Veeam | CVE-2024-29212 | Remote arbitrary code execution | CERTFR-2024-AVI-0374 |
| 9.8 | AIG-301 | Moxa | CVE-2024-21646 & CVE-2024-25110 & CVE-2024-27099 | Remote arbitrary code execution | CERTFR-2024-AVI-0340 |
| 9.8 | Avalanche | Ivanti | CVE-2024-29204 | Remote arbitrary code execution | CERTFR-2024-AVI-0314 |
| 9.8 | Avalanche | Ivanti | CVE-2024-24996 | Remote arbitrary code execution | CERTFR-2024-AVI-0314 |
| 9.8 | Db2 on Cloud Pak for Data , Db2 Warehouse on Cloud Pak for Data (containerd) | IBM | CVE-2021-32760 | Privilege escalation | CERTFR-2024-AVI-0350 |
| 9.8 | ArubaOS | HPE Aruba Networks | CVE-2024-26305 & CVE-2024-26304 & CVE-2024-33511 & CVE-2024-33512 | Remote arbitrary code execution | CERTFR-2024-AVI-0359 |
| 9.8 | SIMATIC CN 4100 | Siemens | CVE-2024-32741 | Remote arbitrary code execution | CERTFR-2024-AVI-0393 |
| 9.8 | Access point with ArubaOS and InstantOS | Aruba Networks | CVE-2024-31473 -> CVE-2024-31468 | Remote arbitrary code execution | CERTFR-2024-AVI-0408 |
| 9.6 | SAP NetWeaver Application Server ABAP and ABAP Platform | SAP | CVE-2024-33006 | Remote arbitrary code execution | CERTFR-2024-AVI-0395 |
| 9.6 | Media Streaming plugin | Qnap | CVE-2023-47222 | Data confidentiality breach | CERTFR-2024-AVI-0362 |
| 9.3 | VMware Workstation, VMware Fusion | VmWare | CVE-2024-22267 | Remote arbitrary code execution | CERTFR-2024-AVI-0405 |
This article provides general information for guidance only. It is neither legal advice nor a contractual commitment from Cyna: service terms are those of the contract agreed through your partner MSP. For any regulatory question, consult your legal adviser.