CVE-2024-2012

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

Published: Jun 11, 2024 / Updated: 5mo ago

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

Vulnerability Summary for the Week of June 10, 2024 bjackson Jun 17, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info actpro -- extra_product_options_for_woocommerce Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6. 2024-06-10 8.8 CVE-2024-35727 audit@patchstack.com adfinis--document-merge-service Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed. 2024-06-11 9.9 CVE-2024-37301 security-advisories@github.com security-advisories@github.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction. 2024-06-13 9.8 CVE-2024-34102 psirt@adobe.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required 2024-06-13 9.1 CVE-2024-34108 psirt@adobe.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation.

Product: ProjectDiscovery Interactsh CVSS Score: 9.8 NVD: NVD References: - - CVE-2024-4295 - The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection in versions up to 5.7.20, allowing unauthenticated attackers to extract sensitive information from the database. Product: Zyxel NAS326 CVSS Score: 9.8 NVD: NVD References: - - CVE-2024-4552 - The Social Login Lite For WooCommerce plugin for WordPress is vulnerable to authentication bypass through social login, allowing unauthenticated attackers to log in as any existing user on the site, up to version 1.6.0.

CVE ID : CVE-2024-2012 Published : June 11, 2024, 2:15 p.m. 12 hours, 59 minutes ago Description : vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior Severity: 9.1 CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...