CVSS: -EPSS: 0%CPEs: -EXPL: 0CVE-2024-48572
https://notcve.org/view.php?id=CVE-2024-48572
A User enumeration vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to obtain email addresses via the "Add a user" feature. The vulnerability occurs due to insufficiently validated user input being processed as a regular expression, which is then matched against email addresses to find duplicate entries. Una vulnerabilidad de enumeración de usuarios en AquilaCMS 1.409.20 y versiones anteriores permite a atacantes no autenticados obtener direcciones de correo electrónico a través de la función "Agregar un usuario". La vulnerabilidad se produce debido a que la entrada de usuario no validada de forma suficiente se procesa como una expresión regular, que luego se compara con las direcciones de correo electrónico para encontrar entradas duplicadas. • https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48572 • CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 0%CPEs: -EXPL: 0CVE-2024-48573
https://notcve.org/view.php?id=CVE-2024-48573
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and administrator account passwords via the "Reset password" feature. Una vulnerabilidad de inyección NoSQL en AquilaCMS 1.409.20 y versiones anteriores permite a atacantes no autenticados restablecer las contraseñas de cuentas de usuario y administrador a través de la función "Restablecer contraseña". • https://github.com/dos-m0nk3y/CVE/tree/main/CVE-2024-48573 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 2.7EPSS: 0%CPEs: -EXPL: 0CVE-2024-44197
https://notcve.org/view.php?id=CVE-2024-44197
A malicious app may be able to cause a denial-of-service. • https://support.apple.com/en-us/121568 https://support.apple.com/en-us/121570 •
CVSS: 6.5EPSS: 0%CPEs: -EXPL: 0CVE-2024-44297
https://notcve.org/view.php?id=CVE-2024-44297
Processing a maliciously crafted message may lead to a denial-of-service. • https://support.apple.com/en-us/121563 https://support.apple.com/en-us/121565 https://support.apple.com/en-us/121566 https://support.apple.com/en-us/121567 https://support.apple.com/en-us/121568 https://support.apple.com/en-us/121569 https://support.apple.com/en-us/121570 •
CVSS: 5.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-47827 – Argo Workflows Controller: Denial of Service via malicious daemon Workflows
https://notcve.org/view.php?id=CVE-2024-47827
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2. • https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75 https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a https://github.com/argoproj/argo-workflows/pull/13641 https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE-1108: Excessive Reliance on Global Variables •