Vulnerabilities

TI-2024-24178 CVE-2024-36392 · GHSA-22p6-c9vr-pq5x

MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

LOW 27

MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00272 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-79

TI-2024-24177 CVE-2024-36391 · GHSA-5h7p-2q7c-v7w8

MEDIUM 47

MileSight DeviceHub - CWE-320: Key Management Errors may allow Authentication Bypass and Man-In-The-Middle Traffic

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00353 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-320

TI-2024-24176 CVE-2024-36390 · GHSA-53mw-3q46-v8vp

LOW 39

MileSight DeviceHub - CWE-20 Improper Input Validation may allow Denial of Service

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00418 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-20

TI-2024-24175 CVE-2024-36389 · GHSA-mwjr-jwf4-2g7p

MEDIUM 49

MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values may allow Authentication Bypass

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00519 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-330

TI-2024-24174 CVE-2024-36388 · GHSA-v38j-rpc7-4g25

MEDIUM 49

MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00473 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-305

TI-2024-18395 CVE-2024-27776 · GHSA-g93h-34rm-55x7

MEDIUM 50

MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') may allow Unauthenticated RCE

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00597 Published 2024-06-02 Fixed in Upgrade to the latest version. CWE-22