CVSS: 7.2EPSS: 0%CPEs: -EXPL: 0CVE-2024-25420
https://notcve.org/view.php?id=CVE-2024-25420
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component. • https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/admin/AdminManager.java https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421 https://www.igniterealtime.org/projects/openfire • CWE-273: Improper Check for Dropped Privileges •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-25421
https://notcve.org/view.php?id=CVE-2024-25421
An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component. • https://github.com/igniterealtime/Openfire/blob/main/xmppserver/src/main/java/org/jivesoftware/openfire/muc/spi/LocalMUCRoomManager.java https://www.hackthebox.com/blog/openfire-cves-explained-CVE-2024-25420-CVE-2024-25421 https://www.igniterealtime.org/projects/openfire • CWE-250: Execution with Unnecessary Privileges •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-24892 – Unauthorized RCE in migration-tools
https://notcve.org/view.php?id=CVE-2024-24892
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files https://gitee.Com/openeuler/migration-tools/blob/master/index.Py. This issue affects migration-tools: from 1.0.0 through 1.0.1. • https://gitee.com/src-openeuler/migration-tools/pulls/12 https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-1275 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE-269: Improper Privilege Management •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-28393
https://notcve.org/view.php?id=CVE-2024-28393
SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess() method. • https://addons.prestashop.com/fr/paiement-en-plusieurs-fois/87023-scalapay-payez-en-3-fois-sans-frais.html https://security.friendsofpresta.org/modules/2024/03/19/scalapay.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-29666
https://notcve.org/view.php?id=CVE-2024-29666
Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to escalate privileges via the default password component. • https://github.com/whgojp/cve-reports/wiki/There-is-a-weak-password-in-the-CMSV6-vehicle-monitoring-platform-system • CWE-1393: Use of Default Password •