Security Vulnerabilities - CVEs Published In February 2024
An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter.
CVSS Score
5.4
EPSS Score
0.001
Published
2024-02-06
A potential attacker with access to the Westermo Lynx device may be able to execute malicious code that could affect the correct functioning of the device.
CVSS Score
8.0
EPSS Score
0.001
Published
2024-02-06
A vulnerability classified as critical has been found in Juanpao JPShop up to 1.5.02. This affects the function actionIndex of the file /api/controllers/admin/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-252999.
CVSS Score
6.3
EPSS Score
0.001
Published
2024-02-06
A vulnerability classified as critical was found in Juanpao JPShop up to 1.5.02. This vulnerability affects the function actionIndex of the file /api/controllers/merchant/app/ComboController.php of the component API. The manipulation of the argument pic_url leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253000.
CVSS Score
6.3
EPSS Score
0.001
Published
2024-02-06
An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.
CVSS Score
8.2
EPSS Score
0.001
Published
2024-02-06
An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets.
CVSS Score
8.2
EPSS Score
0.001
Published
2024-02-06
An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter.
CVSS Score
5.4
EPSS Score
0.001
Published
2024-02-06
An attacker with access to the network where the affected devices are located could maliciously actions to obtain, via a sniffer, sensitive information exchanged via TCP communications.
CVSS Score
5.7
EPSS Score
0.0
Published
2024-02-06
An attacker with access to the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "username" parameter in the SNMP configuration.
CVSS Score
5.4
EPSS Score
0.001
Published
2024-02-06
A potential attacker with access to the Westermo Lynx device would be able to execute malicious code that could affect the correct functioning of the device.
CVSS Score
6.6
EPSS Score
0.0
Published
2024-02-06