Exploit

CVE-2024-5597

Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)

Published: Jun 10, 2024 / Updated: 5mo ago

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric Monitouch V-SFT. Fuji Electric has issued an update to correct this vulnerability.

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available. Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores: High : vulnerabilities with a CVSS base score of 7.0–10.0 Medium : vulnerabilities with a CVSS base score of 4.0–6.9 Low : vulnerabilities with a CVSS base score of 0.0–3.9 Entries may include additional information provided by organizations and efforts sponsored by CISA.

Vulnerability Summary for the Week of June 10, 2024 bjackson Jun 17, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info actpro -- extra_product_options_for_woocommerce Missing Authorization vulnerability in actpro Extra Product Options for WooCommerce.This issue affects Extra Product Options for WooCommerce: from n/a through 3.0.6. 2024-06-10 8.8 CVE-2024-35727 audit@patchstack.com adfinis--document-merge-service Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Versions 6.5.1 and prior are vulnerable to remote code execution via server-side template injection which, when executed as root, can result in full takeover of the affected system. As of time of publication, no patched version exists, nor have any known workarounds been disclosed. 2024-06-11 9.9 CVE-2024-37301 security-advisories@github.com security-advisories@github.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution. An attacker could exploit this vulnerability by sending a crafted XML document that references external entities. Exploitation of this issue does not require user interaction. 2024-06-13 9.8 CVE-2024-34102 psirt@adobe.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, but admin privileges are required 2024-06-13 9.1 CVE-2024-34108 psirt@adobe.com Adobe--Adobe Commerce Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation.

Security Bulletin 12 Jun 2024 Cyber Security Agency of Singapore

High Severity Description Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution. Read more at https://www.tenable.com/cve/CVE-2024-5597