---
title: "Security digest: June 13, 2024"
url: https://erroneo.us/security/2024-06-13/
description: "June 13, 2024 vulnerability digest: 3 CISA KEV additions (Android, Microsoft, Progress); 2 critical advisories (Composer (PHP)). What to patch and who can…"
type: security-digest-day
section: "Security Digest"
date_published: 2024-06-13
date_modified: 2024-06-13
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: June 13, 2024

3 known exploited (cisa kev) additions and 2 critical advisories.

## Take stock

- Do you run any of these? Progress Telerik Report Server, Android Pixel, Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2024-07-04.
- Composer (PHP): 2 critical advisories ( magento/community-edition ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2024-4358](https://erroneo.us/security/cve/CVE-2024-4358/index.md) Progress Telerik Report Server: Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability (CISA due 2024-07-04)
- [CVE-2024-32896](https://erroneo.us/security/cve/CVE-2024-32896/index.md) Android Pixel: Android Pixel Privilege Escalation Vulnerability (CISA due 2024-07-04)
- [CVE-2024-26169](https://erroneo.us/security/cve/CVE-2024-26169/index.md) Microsoft Windows: Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability (CISA due 2024-07-04)

## Critical advisories

- [CVE-2024-34102](https://erroneo.us/security/cve/CVE-2024-34102/index.md) Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability — Composer (PHP) magento/community-edition = 2.4.4 → no fix; Composer (PHP) magento/community-edition >= 2.4.6-p1, < 2.4.6-p6 → 2.4.6-p6; Composer (PHP) magento/community-edition >= 2.4.5-p1, < 2.4.5-p8 → 2.4.5-p8
- [CVE-2024-34103](https://erroneo.us/security/cve/CVE-2024-34103/index.md) Magento Open Source Improper Authentication vulnerability — Composer (PHP) magento/community-edition = 2.4.7 → no fix; Composer (PHP) magento/community-edition = 2.4.6 → no fix; Composer (PHP) magento/community-edition = 2.4.5 → no fix

---
Source page: https://erroneo.us/security/2024-06-13/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt