Exploit

CVE-2024-6244

Cross-Site Request Forgery (CSRF) (CWE-352)

Published: Jul 22, 2024 / Updated: 4mo ago

Vulnerability Summary for the Week of July 22, 2024 bjackson Jul 29, 2024 High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source & Patch Info 202ecommerce--paypal In the module "PayPal Official" for PrestaShop 7+ releases prior to version 6.4.2 and for PrestaShop 1.6 releases prior to version 3.18.1, a malicious customer can confirm an order even if payment is finally declined by PayPal. A logical weakness during the capture of a payment in case of disabled webhooks can be exploited to create an accepted order. This could allow a threat actor to confirm an order with a fraudulent payment support. Versions 6.4.2 and 3.18.1 contain a patch for the issue. Additionally, users enable webhooks and check they are callable. 2024-07-26 7.5 CVE-2024-41670 security-advisories@github.com ABB--Advant MOD 300 AdvaBuild AdvaBuild uses a command queue to launch certain operations. An attacker who gains access to the command queue can use it to launch an attack by running any executable on the AdvaBuild node. The executables that can be run are not limited to AdvaBuild specific executables. Improper Privilege Management vulnerability in ABB Advant MOD 300 AdvaBuild.This issue affects Advant MOD 300 AdvaBuild: from 3.0 through 3.7 SP2. 2024-07-23 8.8 CVE-2020-11640 cybersecurity@ch.abb.com ABB--Advant MOD 300 AdvaBuild An attacker could exploit the vulnerability by injecting garbage data or specially crafted data.

CVE Id : CVE-2024-6244 Published Date: 2024-07-25T15:15:00+00:00 The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks inTheWild added a link to an exploit: https://wpscan.com/vulnerability/73ba55a5-6cff-40fc-9686-30c50f060732/

Update Tue Jul 23 14:35:20 UTC 2024

Medium Severity Description The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks Read more at https://www.tenable.com/cve/CVE-2024-6244

Cvss vector : Cvss Base Score N/A Attack Range N/A Cvss Impact Score N/A Attack Complexity N/A Cvss Expoit Score N/A Authentication N/A Calculate full CVSS 2.0 Vectors scores Cvss vector : N/A Overall CVSS Score NA Base Score NA Environmental Score NA impact SubScore NA Temporal Score NA Exploitabality Sub Score NA Calculate full CVSS 3.0 Vectors scores