CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51560 – Improper Error Handling Vulnerability in Wave 2.0
https://notcve.org/view.php?id=CVE-2024-51560
This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated remote attacker could exploit this vulnerability by providing invalid inputs for “userId” parameter in the API request leading to generation of error message containing sensitive information on the targeted system. • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 • CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51559 – Improper Access Control Vulnerability in Wave 2.0
https://notcve.org/view.php?id=CVE-2024-51559
This vulnerability exists in the Wave 2.0 due to missing authorization check on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter “user_id” through API request URLs which could lead to unauthorized creation, modification and deletion of alerts belonging to other user accounts. • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51558 – Brute Force Attack Vulnerability in Wave 2.0
https://notcve.org/view.php?id=CVE-2024-51558
This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A remote attacker could exploit this vulnerability by conducting a brute force attack against legitimate user OTP, MPIN or password, which could lead to gain unauthorized access and compromise other user accounts. • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51557 – No Rate Limiting Vulnerability in Wave 2.0
https://notcve.org/view.php?id=CVE-2024-51557
This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system. • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 • CWE-799: Improper Control of Interaction Frequency •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51556 – Sensitive Information Disclosure Vulnerability in Wave 2.0
https://notcve.org/view.php?id=CVE-2024-51556
This vulnerability exists in the Wave 2.0 due to weak encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating a parameter “user_id” through API request URLs leading to unauthorized access to sensitive information belonging to other users. • https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2024-0332 • CWE-327: Use of a Broken or Risky Cryptographic Algorithm •