CVE-2024-37770

CVE-2024-37770 description 14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload. Attack Vector Unauthenticated attackers can execute command injecti...

EUVD-2024-36822

Malicious code in bioql PyPI...

CVE-2024-37768

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...

CVE-2024-37767

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770

The 14Finger digital fingerprint collection utility (v1.1) contains a Remote Command Execution (RCE) vulnerability within its fingerprint function. The root cause is improper code generation where the application concatenates a URL into a CMD string and passes it to the Python subprocess module f...

CVE-2024-37770

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37770: Improper Control of Generation of Code

14Finger v1.1 was discovered to contain a remote command execution RCE vulnerability in the fingerprint function. This vulnerability allows attackers to execute arbitrary commands via a crafted payload...

CVE-2024-37767

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...

CVE-2024-37768

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37768

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...

CVE-2024-37769

Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request...

CVE-2024-37768: Undefined Security Weakness

14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id...

CVE-2024-37768

CVE-2024-37768 affects 14Finger v1.1: an arbitrary user deletion vulnerability exists via the endpoint /api/admin/user?id. The CVE entry lists a CRITICAL impact (CVSS v3.1: 9.1) with network access, no user interaction, and no privileges required; impacts include high integrity and high availabil...

PT-2024-27739 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: The issue allows for arbitrary user deletion through the "/api/admin/user?id" API endpoint. This endpoint is used for administrative purposes, and the vulnerability could be exploited to delete users without...

PT-2024-27740 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the software allow attackers to escalate privileges from a normal user to Administrator via a crafted POST request. This issue can be exploited by sending a manipulated POST request to...