Zero-day report: January 2024
CISA added 21 exploited vulnerabilities to its catalog in January 2024, 10 more than December (11). 7 were zero-days, listed within a week of going public. 8 are known to be used by ransomware. The most-hit vendor was Ivanti, with 4.
By technology
Most-hit vendors
Every flaw added in January 2024
- Apple · Multiple ProductsApple Multiple Products Memory Corruption Vulnerability
- Ivanti · Connect Secure, Policy Secure, and NeuronsIvanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability
- Atlassian · Confluence Data Center and ServerAtlassian Confluence Data Center and Server Template Injection Vulnerability
- Apple · Multiple ProductsApple Multiple Products WebKit Type Confusion Vulnerability
- VMware · vCenter ServerVMware vCenter Server Out-of-Bounds Write Vulnerability
- Ivanti · Endpoint Manager Mobile (EPMM) and MobileIron CoreIvanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability
- Citrix · NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Code Injection Vulnerability
- Citrix · NetScaler ADC and NetScaler GatewayCitrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
- Google · Chromium V8Google Chromium V8 Out-of-Bounds Memory Access Vulnerability
- Laravel · Laravel FrameworkLaravel Deserialization of Untrusted Data Vulnerability
- Microsoft · SharePoint ServerMicrosoft SharePoint Server Privilege Escalation Vulnerability
- Ivanti · Connect Secure and Policy SecureIvanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
- Ivanti · Connect Secure and Policy SecureIvanti Connect Secure and Policy Secure Command Injection Vulnerability
- D-Link · DSL-2750B DevicesD-Link DSL-2750B Devices Command Injection Vulnerability
- Joomla! · Joomla!Joomla! Improper Access Control Vulnerability
- Apache · SupersetApache Superset Insecure Default Initialization of Resource Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Deserialization of Untrusted Data Vulnerability
- Adobe · ColdFusionAdobe ColdFusion Deserialization of Untrusted Data Vulnerability
- Apple · Multiple ProductsApple Multiple Products Code Execution Vulnerability
- Google · Chromium WebRTCGoogle Chromium WebRTC Heap Buffer Overflow Vulnerability
- Spreadsheet::ParseExcel · Spreadsheet::ParseExcelSpreadsheet::ParseExcel Remote Code Execution Vulnerability
← December 2023February 2024 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.