CVE-2024-51559 Improper Access Control Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts...

CVE-2024-51559

The CVE-2024-51559 entry applies to Wave 2.0 and is supported by connected documents that describe a vulnerability caused by improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this by manipulating API input parameters (e.g., user_id) to gain una...

CVE-2024-51558 Brute Force Attack Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

CVE-2024-51558 Brute Force Attack Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain...

CVE-2024-51558

The CVE-2024-51558 entry concerns Wave 2.0 where the API-based login lacks restrictions on excessive failed authentication attempts. A remote attacker could perform brute-force attempts against OTP, MPIN, or passwords, potentially gaining unauthorized access and compromising other accounts. Conne...

CVE-2024-51557 No Rate Limiting Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted...

CVE-2024-51557 No Rate Limiting Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted...

CVE-2024-51556 Sensitive Information Disclosure Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556 Sensitive Information Disclosure Vulnerability in Wave 2.0

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensiti...

CVE-2024-51556

The CVE-2024-51556 entry concerns Wave 2.0 with an issue where sensitive data is insufficiently encrypted in API responses. The vulnerability enables an authenticated remote attacker to manipulate API input parameters via the request URL/payload, potentially leading to unauthorized access to othe...

CVE-2024-10746

A vulnerability classified as problematic has been found in PHPGurukul Online Shopping Portal 2.0. This affects an unknown part of the file /admin/assets/plugins/DataTables/media/unittesting/templates/domdata.php. The manipulation of the argument scripts leads to cross site scripting. It is...

CVE-2024-10746

A vulnerability classified as problematic has been found in PHPGurukul Online Shopping Portal 2.0. This affects an unknown part of the file /admin/assets/plugins/DataTables/media/unittesting/templates/domdata.php. The manipulation of the argument scripts leads to cross site scripting. It is...

Ubuntu: Security Advisory (USN-7089-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-34699 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave version 2.0 Description: The issue arises from insufficient encryption of sensitive data received at the API response, allowing an authenticated remote attacker to exploit it by manipulating API input parameters. This could lead to...

EulerOS 2.0 SP12 : vim (EulerOS-SA-2024-2805)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. Vim v9.1.0647 has double free in src/alloc.c:616. When closing a window, the corresponding tagstack...

EulerOS 2.0 SP12 : gtk3 (EulerOS-SA-2024-2800)

According to the versions of the gtk3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current...

EulerOS 2.0 SP12 : python-setuptools (EulerOS-SA-2024-2803)

According to the versions of the python-setuptools package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download...

Huawei EulerOS: Security Advisory for libtiff (EulerOS-SA-2024-2789)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-10744

CVE-2024-10744 affects PHPGurukul Online Shopping Portal 2.0, specifically the /admin/assets/plugins/DataTables/media/unit_testing/templates/complex_header_2.php functionality. The issue is a cross-site scripting flaw triggered by manipulating the scripts parameter, enabling remote exploitation. ...

CBL Mariner 2.0 Security Update: php (CVE-2024-8927)

The version of php installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-8927 advisory. - In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used ...