CVE-2024-37847

An arbitrary file upload vulnerability exists in MangoOS (prior to version 5.1.4) and Mango API (prior to version 4.5.5). The flaw allows an attacker to execute arbitrary code by uploading a crafted file. To remediate this issue, users should update MangoOS to version 5.1.4 or later, and Mango AP...

CVE-2024-37845

MangoOS is affected by CVE-2024-37845: versions prior to 5.2.0 expose an authenticated remote code execution (RCE) vulnerability through the Active Process Command feature. The issue is confirmed by multiple sources in the connected set (including PT-2024-27779 and Red Hat/NVD records). Impact de...

CVE-2024-37846

MangoOS versions prior to 5.2.0 are vulnerable to a Client-Side Template Injection (CSTI) vulnerability. This flaw can be exploited via the Platform Management Edit page . To remediate this issue, it is recommended to update to version 5.2.0 or later . As a temporary workaround, users should rest...

CVE-2024-37844

MangoOS is affected by a stored XSS vulnerability prior to version 5.2.0. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload, impacting web interfaces. Affected: MangoOS before 5.2.0. Root cause: stored XSS in the web context. Impact: potential data exposu...