CVSS: 8.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-1636 – Potential Cross-Site Scripting (XSS) in the page editing area
https://notcve.org/view.php?id=CVE-2024-1636
Potential Cross-Site Scripting (XSS) in the page editing area. • https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024 https://www.progress.com/sitefinity-cms • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-1632 – Incorrect access control in the Sitefinity backend
https://notcve.org/view.php?id=CVE-2024-1632
Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area. • https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2024-1632-and-CVE-2024-1636-February-2024 https://www.progress.com/sitefinity-cms • CWE-284: Improper Access Control •
CVSS: 10.0EPSS: 0%CPEs: 3EXPL: 1CVE-2024-1403 – Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
https://notcve.org/view.php?id=CVE-2024-1403
In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified. The vulnerability is a bypass to authentication based on a failure to properly handle username and password. Certain unexpected content passed into the credentials can lead to unauthorized access without proper authentication. En OpenEdge Authentication Gateway y AdminServer anteriores a 11.7.19, 12.2.14, 12.8.1 en todas las plataformas compatibles con el producto OpenEdge, se identificó una vulnerabilidad de omisión de autenticación. La vulnerabilidad es una omisión de la autenticación basada en una falla al manejar adecuadamente el nombre de usuario y la contraseña. • https://github.com/horizon3ai/CVE-2024-1403 https://community.progress.com/s/article/Important-Critical-Alert-for-OpenEdge-Authentication-Gateway-and-AdminServer https://www.progress.com/openedge • CWE-305: Authentication Bypass by Primary Weakness •
CVSS: 10.0EPSS: 94%CPEs: 3EXPL: 3CVE-2024-1212 – Progress Kemp LoadMaster OS Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-1212
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. Los atacantes remotos no autenticados pueden acceder al sistema a través de la interfaz de administración de LoadMaster, lo que permite la ejecución arbitraria de comandos del sistema. Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution. • https://github.com/Chocapikk/CVE-2024-1212 https://github.com/MuhammadWaseem29/CVE-2024-1212 https://github.com/nak000/CVE-2024-1212 https://freeloadbalancer.com https://kemptechnologies.com https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212 https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 https://rhinosecuritylabs.com/research/cve-2024-1212unauthentic • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1474 – WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface
https://notcve.org/view.php?id=CVE-2024-1474
In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface. En las versiones del servidor WS_FTP anteriores a la 8.8.5, se identificaron problemas de Cross-Site Scripting Reflejado en varias entradas proporcionadas por el usuario en la interfaz administrativa del servidor WS_FTP. • https://community.progress.com/s/article/WS-FTP-Server-Service-Pack-February-2024 https://www.progress.com/ws_ftp • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •