Sec WriteUp ~ CVE Alert

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 19:49:37 +0100 *************** ✏️Title: CVE-2024-42513 | OPC UA .NET Standard Stack prior 1.5.374.158 HTTPS Endpoint improper authentication *************** 📎Link: https://vuldb.com/?id.295142 *************** ⚙️Information: #Vendor: OPC #Product: UA .NET Standard Stack #Risk: critical #Local: No #Remote: Partially #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 19:51:21 +0100 *************** ✏️Title: CVE-2025-1206 | Codezips Gym Management System 1.0 viewdetailroutine.php id sql injection *************** 📎Link: https://vuldb.com/?id.295143 *************** ⚙️Information: #Vendor: Codezips #Product: Gym Management System #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:04:43 +0100 *************** ✏️Title: CVE-2025-1207 | phjounin TFTPD64 4.64 DNS denial of service *************** 📎Link: https://vuldb.com/?id.295144 *************** ⚙️Information: #Vendor: phjounin #Product: TFTPD64 #Risk: problematic #Local: No #Remote: Partially #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:12:23 +0100 *************** ✏️Title: CVE-2025-1208 | code-projects Wazifa System 1.0 /Profile.php postcontent cross site scripting *************** 📎Link: https://vuldb.com/?id.295145 *************** ⚙️Information: #Vendor: code_projects #Product: Wazifa System #Type: Project Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:12:25 +0100 *************** ✏️Title: CVE-2025-1209 | code-projects Wazifa System 1.0 /search_resualts.php searchuser firstname/lastname cross site scripting *************** 📎Link: https://vuldb.com/?id.295146 *************** ⚙️Information: #Vendor: code_projects #Product: Wazifa System #Type: Project Management Software #Risk: problematic #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:12:26 +0100 *************** ✏️Title: CVE-2025-1210 | code-projects Wazifa System 1.0 /controllers/control.php to sql injection *************** 📎Link: https://vuldb.com/?id.295147 *************** ⚙️Information: #Vendor: code_projects #Product: Wazifa System #Type: Project Management Software #Risk: critical #Local: No #Remote: Yes #Exploit: Yes #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:21:37 +0100 *************** ✏️Title: CVE-2025-24200 | Apple iOS/iPadOS up to 17.7.4/18.3.0 USB Restricted Mode improper authorization *************** 📎Link: https://vuldb.com/?id.295148 *************** ⚙️Information: #Vendor: Apple #Product: iOS/iPadOS #Type: Smartphone Operating System #Risk: problematic #Local: Partially #Remote: No #Exploit: Yes #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:27:06 +0100 *************** ✏️Title: CVE-2024-46437 | Tenda W18E 16.01.0.8(1625) Web Management Portal getQuickCfgWifiAndLogin information disclosure *************** 📎Link: https://vuldb.com/?id.295149 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:27:19 +0100 *************** ✏️Title: CVE-2024-46433 | Tenda W18E 16.01.0.8(1625) Web Management Portal default credentials *************** 📎Link: https://vuldb.com/?id.295150 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:27:39 +0100 *************** ✏️Title: CVE-2024-46434 | Tenda W18E 16.01.0.8(1625) Web Management Portal improper authorization *************** 📎Link: https://vuldb.com/?id.295151 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:27:53 +0100 *************** ✏️Title: CVE-2024-46435 | Tenda W18E 16.01.0.8(1625) Web Management Portal delFacebookPic denial of service *************** 📎Link: https://vuldb.com/?id.295152 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:28:15 +0100 *************** ✏️Title: CVE-2024-46430 | Tenda W18E 16.01.0.8(1625) Web Management Portal setLoginPassword improper authentication *************** 📎Link: https://vuldb.com/?id.295153 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:28:39 +0100 *************** ✏️Title: CVE-2024-46432 | Tenda W18E 16.01.0.8(1625) HTTP POST Request setQuickCfgWifiAndLogin access control *************** 📎Link: https://vuldb.com/?id.295154 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:28:53 +0100 *************** ✏️Title: CVE-2024-46431 | Tenda W18E 16.01.0.8(1625) Web Management Portal delWewifiPic buffer overflow *************** 📎Link: https://vuldb.com/?id.295155 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:29:04 +0100 *************** ✏️Title: CVE-2024-46436 | Tenda W18E 16.01.0.8(1625) Telnet Service hard-coded credentials *************** 📎Link: https://vuldb.com/?id.295156 *************** ⚙️Information: #Vendor: Tenda #Product: W18E #Type: Router Operating System #Risk: very critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:32:19 +0100 *************** ✏️Title: CVE-2025-24016 | Wazuh up to 4.9.0 common.py as_wazuh_object deserialization *************** 📎Link: https://vuldb.com/?id.295157 *************** ⚙️Information: #Product: Wazuh #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:32:27 +0100 *************** ✏️Title: CVE-2024-13011 | Chimpstudio WP Foodbakery Plugin up to 4.7 on WordPress upload_publisher_profile_image unrestricted upload *************** 📎Link: https://vuldb.com/?id.295158 *************** ⚙️Information: #Vendor: Chimpstudio #Product: WP Foodbakery Plugin #Type: WordPress Plugin #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:32:44 +0100 *************** ✏️Title: CVE-2024-13059 | mintplex-labs anything-llm up to 1.3.0 Non-ASCII Filename path traversal *************** 📎Link: https://vuldb.com/?id.295159 *************** ⚙️Information: #Vendor: mintplex_labs #Product: anything_llm #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Upgrade *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:33:08 +0100 *************** ✏️Title: CVE-2024-57177 | perfood couch-auth up to 0.21.2 Header Host injection *************** 📎Link: https://vuldb.com/?id.295160 *************** ⚙️Information: #Vendor: perfood #Product: couch_auth #Risk: problematic #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security

‼️ CVE ALERT ‼️ *************** 🗓Date: Mon, 10 Feb 2025 20:33:31 +0100 *************** ✏️Title: CVE-2024-57178 | Stock-Forecaster up to 01-04-2020 portofolio stock-symbol sql injection *************** 📎Link: https://vuldb.com/?id.295161 *************** ⚙️Information: #Product: Stock_Forecaster #Risk: critical #Local: No #Remote: Yes #Exploit: No #Countermeasures: Unknown *************** ♦️Join: @HackTheBox_Academy ♦️Join: @HackTheBox_Security