Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

6 records

Vendor: Brokerage Technology Solutions Component: Wave 2.0 Clear all filters
TI-2024-34476 CVE-2024-51561 · GHSA-wjjv-5wqm-9j59

Authentication bypass Vulnerability in Aero

Priority MEDIUM 49

This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00529 Published 2024-11-04 Fixed in 120820241550 CWE-807
TI-2024-34475 CVE-2024-51560 · GHSA-32h9-hqhx-9j29

Improper Error Handling Vulnerability in Wave 2.0

Priority LOW 31

This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00352 Published 2024-11-04 Fixed in 1.1.7 CWE-209
TI-2024-34474 CVE-2024-51559 · GHSA-hjhx-mr4r-6j6j

Improper Access Control Vulnerability in Wave 2.0

Priority LOW 31

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.0034 Published 2024-11-04 Fixed in 1.1.7 CWE-639
TI-2024-34473 CVE-2024-51558 · GHSA-9xwg-wxgq-6vph

Brute Force Attack Vulnerability in Wave 2.0

Priority MEDIUM 49

This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00568 Published 2024-11-04 Fixed in 1.1.7 CWE-307
TI-2024-34472 CVE-2024-51557 · GHSA-5g37-4gxg-27m8

No Rate Limiting Vulnerability in Wave 2.0

Priority LOW 32

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00466 Published 2024-11-04 Fixed in 1.1.7 CWE-799
TI-2024-34471 CVE-2024-51556 · GHSA-6w35-x982-hj9h

Sensitive Information Disclosure Vulnerability in Wave 2.0

Priority LOW 31

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00214 Published 2024-11-04 Fixed in 1.1.7 CWE-327