CVE-2024-20153

HIGH Year: 2024
CVSS v3 Score
7.5
High
Weakness Type
CWE-304
View all →

Vulnerability Description

In wlan STA, there is a possible way to trick a client to connect to an AP with spoofed SSID. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08990446 / ALPS09057442; Issue ID: MSV-1598.

Related Vulnerabilities

CVE-2023-52424

HIGH
CVSS:7.4(High)

The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or ...

CWE-3042023

CVE-2024-12136

HIGH
CVSS:7.8(High)

Missing Critical Step in Authentication vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Authentication Bypass.This issue affects ANKA JPD-00028: through 19.03.2025. NOTE: The vendor did not...

CWE-3042024

CVE-2024-11302

HIGH
CVSS:8.0(High)

A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerabilit...

CWE-3042024

CVE-2024-9216

HIGH
CVSS:8.1(High)

An authentication bypass vulnerability exists in gaizhenbiao/ChuanhuChatGPT, as of commit 3856d4f, allowing any user to read and delete other users' chat history. The vulnerability arises because the ...

CWE-3042024

CVE-2024-9919

HIGH
CVSS:8.4(High)

A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/{app_name} API endpoint does not call...

CWE-3042024

CVE-2021-41179

MEDIUM
CVSS:6.5(Medium)

Nextcloud is an open-source, self-hosted productivity platform. Prior to Nextcloud Server versions 20.0.13, 21.0.5, and 22.2.0, the Two-Factor Authentication wasn't enforced for pages marked as public...

CWE-3042021