Zero-day report: October 2024
CISA added 17 exploited vulnerabilities to its catalog in October 2024, 8 fewer than September (25). 10 were zero-days, listed within a week of going public. 4 are known to be used by ransomware. The most-hit vendor was Microsoft, with 4.
By technology
Most-hit vendors
Every flaw added in October 2024
- Cisco · Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD)Cisco ASA and FTD Denial-of-Service Vulnerability
- Roundcube · WebmailRoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
- Fortinet · FortiManagerFortinet FortiManager Missing Authentication Vulnerability
- Microsoft · SharePointMicrosoft SharePoint Deserialization Vulnerability
- ScienceLogic · SL1ScienceLogic SL1 Unspecified Vulnerability
- Veeam · Backup & ReplicationVeeam Backup and Replication Deserialization Vulnerability
- SolarWinds · Web Help DeskSolarWinds Web Help Desk Hardcoded Credential Vulnerability
- Microsoft · Windows Microsoft Windows Kernel TOCTOU Race Condition Vulnerability
- Mozilla · FirefoxMozilla Firefox Use-After-Free Vulnerability
- Fortinet · Multiple ProductsFortinet Multiple Products Format String Vulnerability
- Ivanti · Cloud Services Appliance (CSA)Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability
- Ivanti · Cloud Services Appliance (CSA)Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
- Qualcomm · Multiple Chipsets Qualcomm Multiple Chipsets Use-After-Free Vulnerability
- Microsoft · WindowsMicrosoft Windows Management Console Remote Code Execution Vulnerability
- Microsoft · WindowsMicrosoft Windows MSHTML Platform Spoofing Vulnerability
- Synacor · Zimbra Collaboration Suite (ZCS)Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
- Ivanti · Endpoint Manager (EPM)Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability
← September 2024November 2024 →
Source: CISA's Known Exploited Vulnerabilities catalog, by the date CISA added each flaw. Ransomware use is CISA's flag.