CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0320 – Cross-Site Scripting in FireEye Malware Analysis (AX)
https://notcve.org/view.php?id=CVE-2024-0320
Cross-Site Scripting in FireEye Malware Analysis (AX) affecting version 9.0.3.936530. This vulnerability allows an attacker to send a specially crafted JavaScript payload in the application URL to retrieve the session details of a legitimate user. Cross site scripting en FireEye Malware Analysis (AX) que afectan la versión 9.0.3.936530. Esta vulnerabilidad permite a un atacante enviar un paylaod de JavaScript especialmente manipulado en la URL de la aplicación para recuperar los detalles de la sesión de un usuario legítimo. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0319 – Open Redirect vulnerability in FireEye HXTool
https://notcve.org/view.php?id=CVE-2024-0319
Open Redirect vulnerability in FireEye HXTool affecting version 4.6, the exploitation of which could allow an attacker to redirect a legitimate user to a malicious page by changing the 'redirect_uri' parameter. Vulnerabilidad de Open Redirect en FireEye HXTool que afecta a la versión 4.6, cuya explotación podría permitir a un atacante redirigir a un usuario legítimo a una página maliciosa cambiando el parámetro 'redirect_uri'. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0318 – Cross-Site Scripting in FireEye HXTool
https://notcve.org/view.php?id=CVE-2024-0318
Cross-Site Scripting in FireEye HXTool affecting version 4.6. This vulnerability allows an attacker to store a specially crafted JavaScript payload in the 'Profile Name' and 'Hostname/IP' parameters that will be triggered when items are loaded. Cross-Site Scripting en FireEye HXTool que afecta a la versión 4.6. Esta vulnerabilidad permite a un atacante almacenar un payload de JavaScript especialmente manipulado en los parámetros 'Profile Name' y 'Hostname/IP' que se activarán cuando se carguen elementos. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2024-0317 – Cross-Site Scripting in FireEye EX
https://notcve.org/view.php?id=CVE-2024-0317
Cross-Site Scripting in FireEye EX, affecting version 9.0.3.936727. Exploitation of this vulnerability allows an attacker to send a specially crafted JavaScript payload via the 'type' and 's_f_name' parameters to an authenticated user to retrieve their session details. Cross site scripting en FireEye EX, que afectan a la versión 9.0.3.936727. La explotación de esta vulnerabilidad permite a un atacante enviar un payload de JavaScript especialmente manipulado a través de los parámetros 'type' y 's_f_name' a un usuario autenticado para recuperar los detalles de su sesión. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0316 – Improper cleanup vulnerability in FireEye Endpoint Security
https://notcve.org/view.php?id=CVE-2024-0316
Improper cleanup vulnerability in exceptions thrown in FireEye Endpoint Security, affecting version 5.2.0.958244. This vulnerability could allow an attacker to send multiple request packets to the containment_notify/preview parameter, which could lead to a service outage. Vulnerabilidad de limpieza incorrecta en excepciones lanzadas en FireEye Endpoint Security, que afecta la versión 5.2.0.958244. Esta vulnerabilidad podría permitir a un atacante enviar múltiples paquetes de solicitud al parámetro containment_notify/preview, lo que podría provocar una interrupción del servicio. • https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-fireeye-products • CWE-460: Improper Cleanup on Thrown Exception •