Vulnerability Summary for the ... Note

Vulnerability Summary for the Week of June 17, 2024

Multiple vulnerabilities have been discovered in various software products, including WordPress plugins, operating systems, and security software. The Shariff Wrapper plugin for WordPress has a Local File Inclusion vulnerability that allows unauthenticated attackers to execute arbitrary files on the server. AMD Ryzen Threadripper PRO Processors have a potential weakness in SPI protection features that may allow malicious attackers to bypass native System Management Mode ROM protections. Several WordPress plugins, including Ali2Woo, Artbees, Averta, and Bill Minozzi, have vulnerabilities such as Cross-Site Request Forgery, Incorrect Authorization, and Missing Authorization. Canonical Ltd.'s snapd has a vulnerability that may grant additional privileges to a container within the snap. IBM QRadar Suite Software, IBM Security SOAR, and IBM WebSphere Application Server have vulnerabilities that allow authenticated users to execute arbitrary commands or escalate privileges. Intelbras InControl has a vulnerability that allows local access to approach an attack and execute arbitrary system commands. Live Composer Team's Page Builder has a Deserialization of Untrusted Data vulnerability that affects all versions up to 1.5.42. Openfind's MailGates and MailAudit have a vulnerability that allows unauthenticated remote attackers to inject system commands and execute them on the remote server. These vulnerabilities have been assigned CVE numbers and have been reported to the respective vendors for patching.