Zero-day report: August 2024
CISA added 19 exploited vulnerabilities to its catalog in August 2024, 5 more than July (14). 10 were zero-days, listed within a week of going public. 1 is known to be used by ransomware. The most-hit vendor was Microsoft, with 8.
By technology
Most-hit vendors
Every flaw added in August 2024
- Google · Chromium V8Google Chromium V8 Inappropriate Implementation Vulnerability
- Apache · OFBizApache OFBiz Incorrect Authorization Vulnerability
- Google · Chromium V8Google Chromium V8 Type Confusion Vulnerability
- Versa · DirectorVersa Director Dangerous File Type Upload Vulnerability
- Microsoft · Exchange ServerMicrosoft Exchange Server Information Disclosure Vulnerability
- Dahua · IP Camera FirmwareDahua IP Camera Authentication Bypass Vulnerability
- Dahua · IP Camera FirmwareDahua IP Camera Authentication Bypass Vulnerability
- Linux · KernelLinux Kernel Heap-Based Buffer Overflow Vulnerability
- Jenkins · Jenkins Command Line Interface (CLI)Jenkins Command Line Interface (CLI) Path Traversal Vulnerability
- SolarWinds · Web Help DeskSolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
- Microsoft · WindowsMicrosoft Windows Kernel Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows Scripting Engine Memory Corruption Vulnerability
- Microsoft · ProjectMicrosoft Project Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability
- Microsoft · WindowsMicrosoft Windows SmartScreen Security Feature Bypass Vulnerability
- Apache · OFBizApache OFBiz Path Traversal Vulnerability
- Android · KernelAndroid Kernel Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft COM for Windows Deserialization of Untrusted Data Vulnerability
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.