CVE-2024-27092

MEDIUM Year: 2024
CVSS v3 Score
5.4
Medium
Weakness Type
CWE-20
View all →

Vulnerability Description

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label (Edit Team) - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload (external link) is presented in clickable form - easier to achieve own goals by malicious actors. This issue is fixed in 2023.12.6.

Related Vulnerabilities

CVE-2015-5296

MEDIUM
CVSS:5.4(Medium)

Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3 supports connections that are encrypted but unsigned, which allows man-in-the-middle attackers to conduct encrypted-to-unenc...

CWE-202015

CVE-2015-8688

MEDIUM
CVSS:5.4(Medium)

Gajim before 0.16.5 allows remote attackers to modify the roster and intercept messages via a crafted roster-push IQ stanza.

CWE-202015

CVE-2016-0207

MEDIUM
CVSS:5.4(Medium)

IBM Algorithmics One-Algo Risk Application (ARA) 4.9.1 through 5.1.0 allows remote authenticated users to conduct clickjacking attacks via unspecified vectors. IBM X-Force ID: 109399.

CWE-202016

CVE-2016-0300

MEDIUM
CVSS:5.4(Medium)

IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validat...

CWE-202016

CVE-2016-4590

MEDIUM
CVSS:5.4(Medium)

WebKit in Apple iOS before 9.3.3 and Safari before 9.1.2 mishandles about: URLs, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.

CWE-202016

CVE-2017-0074

MEDIUM
CVSS:5.4(Medium)

Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS...

CWE-202017