CVE-2024-47557

CVE-2024-47557

Título es
CVE-2024-47557

Lun, 07/10/2024 – 19:15

Tipo
CWE-22

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2024-47557

Descripción en
Pre-Auth RCE via Path Traversal

07/10/2024
07/10/2024
Vector CVSS:3.1
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Gravedad 3.1 (CVSS 3.1 Base Score)
8.30

Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
HIGH

Referencias

  • https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf

    • Enviar en el boletín
    Off

    CVE-2024-47556

    CVE-2024-47556

    Título es
    CVE-2024-47556

    Lun, 07/10/2024 – 19:15

    Tipo
    CWE-22

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-47556

    Descripción en
    Pre-Auth RCE via Path Traversal

    07/10/2024
    07/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    8.30

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-014-for-Xerox%C2%AE-FreeFlow%C2%AE-Core-v7.0-.pdf

    • Enviar en el boletín
    Off

    CVE-2024-9570

    CVE-2024-9570

    Título es
    CVE-2024-9570

    Lun, 07/10/2024 – 16:15

    Tipo
    CWE-120

    Gravedad v2.0
    9.00

    Gravedad 2.0 Txt
    HIGH

    Título en

    CVE-2024-9570

    Descripción en
    A vulnerability was found in D-Link DIR-619L B1 2.06 and classified as critical. Affected by this issue is the function formEasySetTimezone of the file /goform/formEasySetTimezone. The manipulation of the argument curTime leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

    07/10/2024
    07/10/2024
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

    Vector CVSS:2.0
    AV:N/AC:L/Au:S/C:C/I:C/A:C

    Gravedad 3.1 (CVSS 3.1 Base Score)
    8.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    HIGH

    Referencias

  • https://github.com/abcdefg-png/IoT-vulnerable/blob/main/D-Link/DIR-619L/formEasySetTimezone.md

  • https://vuldb.com/?ctiid_279464=

  • https://vuldb.com/?id_279464=

  • https://vuldb.com/?submit_414548=

  • https://www.dlink.com/

    • Enviar en el boletín
    Off

    CVE-2024-46446

    CVE-2024-46446

    Título es
    CVE-2024-46446

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-46446

    Descripción en
    Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • http://mecha-cmscom.com

  • https://github.com/Sp1d3rL1/Mecha-cms-Arbitrary-File-Deletion-Vulnerability

    • Enviar en el boletín
    Off

    CVE-2024-46278

    CVE-2024-46278

    Título es
    CVE-2024-46278

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-46278

    Descripción en
    Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://github.com/ayato-shitomi/CVE-2024-46278-teedy_1.11_account-takeover

  • https://github.com/ayato-shitomi/teedy_1.11_account-takeover

    • Enviar en el boletín
    Off

    CVE-2024-46041

    CVE-2024-46041

    Título es
    CVE-2024-46041

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-46041

    Descripción en
    IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://github.com/Anonymous120386/Anonymous

  • Home


    • Enviar en el boletín
    Off

    CVE-2024-46040

    CVE-2024-46040

    Título es
    CVE-2024-46040

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-46040

    Descripción en
    IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. The lack of validation of the authentication token at the IoT Haat during the Access Point Pairing mode leads the attacker to replay the Wi-Fi packets and forcefully turn off the access point after the authentication token has expired.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://github.com/Anonymous120386/Anonymous

  • Home


    • Enviar en el boletín
    Off

    CVE-2024-28710

    CVE-2024-28710

    Título es
    CVE-2024-28710

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-28710

    Descripción en
    Cross Site Scripting vulnerability in LimeSurvey before 6.5.0+240319 allows a remote attacker to execute arbitrary code via a lack of input validation and output encoding in the Alert Widget's message component.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • http://limesurvey.com

  • https://github.com/LimeSurvey/LimeSurvey/commit/c2fd60f94bc1db275f20cbb27a3135a9bdfb7f10

    • Enviar en el boletín
    Off

    CVE-2024-28709

    CVE-2024-28709

    Título es
    CVE-2024-28709

    Lun, 07/10/2024 – 16:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-28709

    Descripción en
    Cross Site Scripting vulnerability in LimeSurvey before 6.5.12+240611 allows a remote attacker to execute arbitrary code via a crafted script to the title and comment fields.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • http://limesurvey.com

  • https://github.com/LimeSurvey/LimeSurvey/commit/c844c4fba81cc26ffe6544bf095bad6252910bc0

    • Enviar en el boletín
    Off

    CVE-2024-46300

    CVE-2024-46300

    Título es
    CVE-2024-46300

    Lun, 07/10/2024 – 17:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-46300

    Descripción en
    itsourcecode Placement Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Full Name field in registration.php.

    07/10/2024
    07/10/2024
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://github.com/riya98241/CVE/blob/main/CVE-2024-46300

  • https://portswigger.net/web-security/cross-site-scripting/stored

    • Enviar en el boletín
    Off