Latest Vulnerabilities Updates: AppSecWorld's CVE Daily Digest for March 23-24, 2024

In the dynamic realm of cybersecurity, staying updated on the latest vulnerabilities is imperative.
This edition of the AppSecWorld's CVE Daily Digest provides a snapshot of the vulnerabilities published in National Vulnerability Database between March 23-24, 2024.
During this period, The National Vulnerability Database published 18, and these new Common Vulnerabilities and Exposures (CVEs) are classified as follows:

Critical: 0
High: 5
Medium: 10
Low: 1
Severity Not Assigned: 2

Identifying and understanding these vulnerabilities are pivotal steps towards enhancing security measures and creating a safer digital environment.
Now, let's delve deeper into AppSecWorld's CVE Daily Digest, spotlighting the Critical and High Severity vulnerabilities that demand immediate attention.

1. CVE-2024-29059
Base Score: 7.5
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 3.6
Description: .NET Framework Information Disclosure Vulnerability
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29059

CWE-ID: Not assigned as of now
Common Platform Enumerations (CPE): Not Found

2. CVE-2024-2025
Base Score: 8.8
Base Severity: HIGH
Exploitability Score: 2.8
Impact Score: 5.9
Description: The "BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages" plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.4.20 via deserialization of untrusted input in the get_simple_request function. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
References: https://plugins.trac.wordpress.org/changeset/3055634/wc4bp/trunk/class/includes/class-request-helper.php
https://www.wordfence.com/threat-intel/vulnerabilities/id/78da9e79-399e-43e3-ac27-a162861cae71?source=cve

CWE-ID: Not assigned as of now
Common Platform Enumerations (CPE): Not Found

3. CVE-2021-33633
Base Score: 7.3
Base Severity: HIGH
Exploitability Score: 1.3
Impact Score: 5.9
Description: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in openEuler aops-ceres on Linux allows Command Injection. This vulnerability is associated with program files ceres/function/util.Py.

This issue affects aops-ceres: from 1.3.0 through 1.4.1.


References: https://gitee.com/src-openeuler/aops-ceres/pulls/158
https://gitee.com/src-openeuler/aops-ceres/pulls/159
https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1159

CWE-ID: CWE-78
Common Platform Enumerations (CPE): Not Found

4. CVE-2024-24832
Base Score: 8.2
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 4.2
Description: Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.


References: https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-3-9-broken-access-control-vulnerability?_s_id=cve

CWE-ID: CWE-862
Common Platform Enumerations (CPE): Not Found

5. CVE-2024-1603
Base Score: 8.2
Base Severity: HIGH
Exploitability Score: 3.9
Impact Score: 4.2
Description: paddlepaddle/paddle 2.6.0 allows arbitrary file read via paddle.vision.ops.read_file.
References: https://huntr.com/bounties/7739eced-73a3-4a96-afcd-9c753c55929e

CWE-ID: CWE-73
Common Platform Enumerations (CPE): Not Found