CVE-2024-7798

CVE-2024-7798

Título es
CVE-2024-7798

Jue, 15/08/2024 – 00:15

Tipo
CWE-89

Gravedad v2.0
7.50

Gravedad 2.0 Txt
HIGH

Título en

CVE-2024-7798

Descripción en
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

15/08/2024
15/08/2024
Vector CVSS:3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Vector CVSS:2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P

Gravedad 3.1 (CVSS 3.1 Base Score)
7.30

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
HIGH

Referencias

  • https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql2.md

  • https://vuldb.com/?ctiid_274651=

  • https://vuldb.com/?id_274651=

  • https://vuldb.com/?submit_390297=

    • Enviar en el boletín
    Off

    CVE-2024-7800

    CVE-2024-7800

    Título es
    CVE-2024-7800

    Jue, 15/08/2024 – 00:15

    Tipo
    CWE-89

    Gravedad v2.0
    6.50

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2024-7800

    Descripción en
    A vulnerability classified as critical has been found in SourceCodester Simple Online Bidding System 1.0. This affects an unknown part of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=delete_product. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

    15/08/2024
    15/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

    Vector CVSS:2.0
    AV:N/AC:L/Au:S/C:P/I:P/A:P

    Gravedad 3.1 (CVSS 3.1 Base Score)
    6.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql3.md

  • https://vuldb.com/?ctiid_274653=

  • https://vuldb.com/?id_274653=

  • https://vuldb.com/?submit_390773=

    • Enviar en el boletín
    Off

    CVE-2024-7799

    CVE-2024-7799

    Título es
    CVE-2024-7799

    Jue, 15/08/2024 – 00:15

    Tipo
    CWE-285

    Gravedad v2.0
    5.00

    Gravedad 2.0 Txt
    MEDIUM

    Título en

    CVE-2024-7799

    Descripción en
    A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /simple-online-bidding-system/bidding/admin/users.php. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

    15/08/2024
    15/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

    Vector CVSS:2.0
    AV:N/AC:L/Au:N/C:P/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://github.com/Wsstiger/cve/blob/main/Sourcecoster_unauthorized.md

  • https://vuldb.com/?ctiid_274652=

  • https://vuldb.com/?id_274652=

  • https://vuldb.com/?submit_390302=

    • Enviar en el boletín
    Off

    CVE-2024-7808

    CVE-2024-7808

    Título es
    CVE-2024-7808

    Jue, 15/08/2024 – 01:15

    Tipo
    CWE-89

    Gravedad v2.0
    7.50

    Gravedad 2.0 Txt
    HIGH

    Título en

    CVE-2024-7808

    Descripción en
    A vulnerability was found in code-projects Job Portal 1.0. It has been classified as critical. Affected is an unknown function of the file logindbc.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

    15/08/2024
    15/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

    Vector CVSS:2.0
    AV:N/AC:L/Au:N/C:P/I:P/A:P

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://github.com/XYgit-99/cve/issues/1

  • https://vuldb.com/?ctiid_274704=

  • https://vuldb.com/?id_274704=

  • https://vuldb.com/?submit_390329=

    • Enviar en el boletín
    Off

    CVE-2024-7797

    CVE-2024-7797

    Título es
    CVE-2024-7797

    Jue, 15/08/2024 – 00:15

    Tipo
    CWE-89

    Gravedad v2.0
    7.50

    Gravedad 2.0 Txt
    HIGH

    Título en

    CVE-2024-7797

    Descripción en
    A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been classified as critical. Affected is an unknown function of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

    15/08/2024
    15/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

    Vector CVSS:2.0
    AV:N/AC:L/Au:N/C:P/I:P/A:P

    Gravedad 3.1 (CVSS 3.1 Base Score)
    7.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://github.com/Wsstiger/cve/blob/main/Sourcecoster_sql.md

  • https://vuldb.com/?ctiid_274650=

  • https://vuldb.com/?id_274650=

  • https://vuldb.com/?submit_390290=

    • Enviar en el boletín
    Off

    CVE-2024-7625 | INCIBE-CERT | INCIBE

    Descripción

    *** Pendiente de traducción *** In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.16.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability.

    CVE-2024-6078 | INCIBE-CERT | INCIBE

    Descripción

    *** Pendiente de traducción *** CVE-2024-6078 IMPACT
    An improper authentication vulnerability exists in the affected product, which could allow a malicious user to generate cookies for any user ID without the use of a username or password. If exploited, a malicious user could take over the account of a legitimate user. The malicious user would be able to view and modify data stored in the cloud.

    CVE-2024-42360

    CVE-2024-42360

    Título es
    CVE-2024-42360

    Mié, 14/08/2024 – 20:15

    Tipo
    CWE-77

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-42360

    Descripción en
    SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell commands. This vulnerability has been fixed in 3.1.2.

    14/08/2024
    14/08/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    9.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    CRITICAL

    Referencias

  • https://github.com/wurmlab/sequenceserver/commit/457e52709f7f9ed2fceed59b3db564cb50785dba

  • https://github.com/wurmlab/sequenceserver/security/advisories/GHSA-qv32-5wm2-p32h

    • Enviar en el boletín
    Off

    CVE-2024-40620 | INCIBE-CERT | INCIBE

    Descripción

    *** Pendiente de traducción *** CVE-2024-40620 IMPACT
    A vulnerability exists in the affected product due to lack of encryption of sensitive information. The vulnerability results in data being sent between the Console and the Dashboard without encryption, which can be seen in the logs of proxy servers, potentially impacting the data's confidentiality.