cisa.gov | Bulletins
Follow
Vulnerability Summary for the Week of October 21, 2024
Several high vulnerabilities have been reported in various products, including Admin Verbalize WP, advancedcoding Comments wpDiscuz, Alexander De Ridder INK Official, Amazon ApplicationLoadBalancer Identity AspNetCore Middleware, and Amazon AWS ALB Route Directive Adapter For Istio. These vulnerabilities include unrestricted upload of file with dangerous type, authentication bypass, and insufficient validation of user input. The Admin Verbalize WP plugin for WordPress has a vulnerability that allows an attacker to upload a web shell to a web server, while the advancedcoding Comments wpDiscuz plugin has an authentication bypass vulnerability that allows an attacker to log in as any existing user. The Alexander De Ridder INK Official plugin also has an unrestricted upload of file with dangerous type vulnerability.The Amazon ApplicationLoadBalancer Identity AspNetCore Middleware and Amazon AWS ALB Route Directive Adapter For Istio have vulnerabilities that allow an attacker to spoof OIDC-federated sessions and bypass authentication. Other products with reported vulnerabilities include appcheap App Builder, baserproject basercms, buddypress BuddyPress, and Cisco Adaptive Security Appliance Software. The vulnerabilities in these products include privilege escalation, cross-site scripting, directory traversal, and denial of service conditions. It is essential to patch these vulnerabilities to prevent potential attacks and ensure the security of the affected systems.