b1ackc4t records
4 published records for vendor b1ackc4t.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 0%
- Median publish → KEV
- No record has entered KEV
Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.
Recurring classes
- CWE-278 Insecure Preserved Inherited Permissions1
- CWE-306 Missing Authentication for Critical Function1
- CWE-94 Improper Control of Generation of Code ('Code Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
4 records| Action | CVE | Vulnerability | Severity | EPSS · Published |
|---|---|---|---|---|
36Monitor | CVE-2024-37770Proof of concept | 14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.b1ackc4t · 14finger · CWE-94 | Critical9.1 | 1.5%Jul 10, 2024 |
36Monitor | CVE-2024-37768No exploit | 14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.b1ackc4t · 14finger | Critical9.1 | 0.5%Jul 5, 2024 |
35Monitor | CVE-2024-37769No exploit | Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.b1ackc4t · 14finger · CWE-278 | High8.8 | 0.4%Jul 5, 2024 |
30Monitor | CVE-2024-37767No exploit | Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET reqb1ackc4t · 14finger · CWE-306 | High7.5 | 0.3%Jul 5, 2024 |
- CVE-2024-3777036Monitor
14Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function.
CriticalCVSS 9.1Proof of conceptEPSS 1%b1ackc4t · 14fingerJul 10, 2024
- CVE-2024-3776836Monitor
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.
CriticalCVSS 9.1No exploitEPSS 0%b1ackc4t · 14fingerJul 5, 2024
- CVE-2024-3776935Monitor
Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.
HighCVSS 8.8No exploitEPSS 0%b1ackc4t · 14fingerJul 5, 2024
- CVE-2024-3776730Monitor
Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET req
HighCVSS 7.5No exploitEPSS 0%b1ackc4t · 14fingerJul 5, 2024