6 matches found
CVE-2024-25283
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2024-25282
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage...
CVE-2024-25283
The CVE-2024-25283 entry concerns 3DSecure 2.0, specifically the 3DS Authorization Challenge. A reflected Cross‑Site Scripting (XSS) vulnerability exists in the /rest/online endpoint where the modified params parameter in a /redirect?action=challenge&txn=… URL is not sanitized, enabling injection...
CVE-2024-25282
Redsys 3DSecure 2.0 (3DS Method Authentication) is reported vulnerable to Cross‑Site Scripting (XSS) via a modified params parameter in a /rest/online request with a /redirect?action=challenge&txn=... path. Root cause: insufficient sanitization/validation of the params field, which is base64-enco...