cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of January 27, 2025
Multiple vulnerabilities have been discovered in various products, including 0xPolygonZero's plonky2, 1000 Projects' Employee Task Management System, aakashbhagat's single_user_chat, ABB's FLXEON, Acronis' Cyber Protect Cloud Agent, and Akamai's Enterprise Application Access. These vulnerabilities can lead to issues such as SQL injection, unauthorized modification of data, arbitrary code execution, and denial of service. Some of these vulnerabilities have been fixed in recent updates, including plonky2 version 1.0.1 and Acronis Cyber Protect Cloud Agent build 39378. Other affected products include Alpine's Halo9, AlgolPlus' Advanced Dynamic Pricing for WooCommerce, and Alessandro Piconi's Internal Link Builder. Apple has also released patches for several vulnerabilities in its products, including iOS, iPadOS, macOS, watchOS, and tvOS. These vulnerabilities can lead to issues such as fingerprinting, corrupting coprocessor memory, and elevating privileges. Apple has addressed these issues with improved bounds checks, memory handling, and input validation. Users are advised to update their products to the latest versions to prevent potential attacks.