Zero-day report: June 2024
CISA added 9 exploited vulnerabilities to its catalog in June 2024, 5 fewer than May (14). 3 were zero-days, listed within a week of going public. 2 are known to be used by ransomware. The most-hit vendor was Android, with 1.
By technology
Most-hit vendors
Every flaw added in June 2024
- Roundcube · WebmailRoundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- OSGeo · JAI-EXTOSGeo GeoServer JAI-EXT Code Injection Vulnerability
- Linux · KernelLinux Kernel Use-After-Free Vulnerability
- Microsoft · WindowsMicrosoft Windows Error Reporting Service Improper Privilege Management Vulnerability
- Android · PixelAndroid Pixel Privilege Escalation Vulnerability
- Progress · Telerik Report ServerProgress Telerik Report Server Authentication Bypass by Spoofing Vulnerability
- PHP Group · PHPPHP-CGI OS Command Injection Vulnerability
- Arm · Mali GPU Kernel DriverArm Mali GPU Kernel Driver Use-After-Free Vulnerability
- Oracle · WebLogic ServerOracle WebLogic Server OS Command Injection Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.