CVE-2024-37847

The CVE-2024-37847 entry documents an arbitrary file upload vulnerability affecting MangoOS before 5.1.4 and Mango API before 4.5.5, enabling arbitrary code execution via a crafted file. Affected components: MangoOS and Mango API (versions prior to listed fixes). Root cause: improper handling of ...

CVE-2024-37846

MangoOS before 5.2.0 is affected by a Client-Side Template Injection (CSTI) vulnerability exposed on the Platform Management Edit page. The issue is tied to the Platform Management Edit page and allows CSTI, with sources indicating that versions prior to 5.2.0 are vulnerable. The connected Red Ha...

CVE-2024-37845

MangoOS is affected by CVE-2024-37845: versions prior to 5.2.0 expose an authenticated remote code execution (RCE) vulnerability through the Active Process Command feature. The issue is confirmed by multiple sources in the connected set (including PT-2024-27779 and Red Hat/NVD records). Impact de...

CVE-2024-37844

MangoOS is affected by a stored XSS vulnerability prior to version 5.2.0. The issue allows an attacker to execute arbitrary web scripts or HTML via a crafted payload, impacting web interfaces. Affected: MangoOS before 5.2.0. Root cause: stored XSS in the web context. Impact: potential data exposu...