CVE-2024-57669

CVE-2024-57669

Título es
CVE-2024-57669

Lun, 03/02/2025 – 20:15

Gravedad 2.0 Txt
Pendiente de análisis

Título en

CVE-2024-57669

Descripción en
Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file.

03/02/2025
03/02/2025
Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
Pendiente de análisis

Referencias

  • https://github.com/94fzb/zrlog-plugin-backup-sql-file/commit/32bdb36e6cc4f0b72e1ba85ef4458fb980946ea4

  • https://github.com/94fzb/zrlog/issues/193

  • https://github.com/HypeDuke/vulnerable-research/blob/main/CVE-2024-57669

    • Enviar en el boletín
    Off

    CVE-2024-57498

    CVE-2024-57498

    Título es
    CVE-2024-57498

    Lun, 03/02/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-57498

    Descripción en
    Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function.

    03/02/2025
    03/02/2025
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://gist.github.com/Catherines77/ac0b554f3d755879eb12bfd69ef585b1

  • https://github.com/saysky/ForestBlog/issues/102

    • Enviar en el boletín
    Off

    CVE-2024-57099

    CVE-2024-57099

    Título es
    CVE-2024-57099

    Lun, 03/02/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-57099

    Descripción en
    ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model management feature, allowing them to execute arbitrary code and potentially take control of the server.

    03/02/2025
    03/02/2025
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://github.com/ClassCMS/ClassCMS/issues/6

    • Enviar en el boletín
    Off

    CVE-2024-57968

    CVE-2024-57968

    Título es
    CVE-2024-57968

    Lun, 03/02/2025 – 20:15

    Tipo
    CWE-434

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2024-57968

    Descripción en
    Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.

    03/02/2025
    03/02/2025
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

    Gravedad 3.1 (CVSS 3.1 Base Score)
    9.90

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    CRITICAL

    Referencias

  • https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1

  • XE Group: From Credit Card Skimming to Exploiting Zero-Days


    • Enviar en el boletín
    Off

    CVE-2025-25181

    CVE-2025-25181

    Título es
    CVE-2025-25181

    Lun, 03/02/2025 – 20:15

    Tipo
    CWE-89

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25181

    Descripción en
    A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.

    03/02/2025
    03/02/2025
    Vector CVSS:3.1
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

    Gravedad 3.1 (CVSS 3.1 Base Score)
    5.80

    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    MEDIUM

    Referencias

  • https://advantive.my.site.com/support/s/knowledge

  • XE Group: From Credit Card Skimming to Exploiting Zero-Days


    • Enviar en el boletín
    Off

    CVE-2025-25065

    CVE-2025-25065

    Título es
    CVE-2025-25065

    Lun, 03/02/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25065

    Descripción en
    SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.

    03/02/2025
    03/02/2025
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes

  • https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes

  • https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43#Security_Fixes

  • https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

    • Enviar en el boletín
    Off

    CVE-2025-25064

    CVE-2025-25064

    Título es
    CVE-2025-25064

    Lun, 03/02/2025 – 20:15

    Gravedad 2.0 Txt
    Pendiente de análisis

    Título en

    CVE-2025-25064

    Descripción en
    SQL injection vulnerability in the ZimbraSyncService SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4.

    03/02/2025
    03/02/2025
    Gravedad 3.1 Txt Gravedad 3.1 (CVSS 3.1 Base Score)
    Pendiente de análisis

    Referencias

  • https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes

  • https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes

  • https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

    • Enviar en el boletín
    Off