CVE-2024-39886

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

TONE store App version 3.4.2 and earlier contains an issue with unprotected primary channel. Since TONE store App communicates with TONE store website in cleartext, a man-in-the-middle attack may allow an attacker to obtain and/or alter communications of the affected App.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-419

Affected software

VendorProductVersions
DREAM TRAIN INTERNET INC.TONE store Appversion 3.4.2 and earlier

References

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-398879.8An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. SpecificalCVE-2024-398887.5A vulnerability has been identified in Mendix Encryption (All versions >= V10.0.0 < V10.0.2). Affected versions of the module define a speciCVE-2024-39895.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery JustiCVE-2024-398908.1An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200,CVE-2024-398915.3In the Twilio Authy API, accessed by Authy Android before 25.1.0 and Authy iOS before 26.1.0, an unauthenticated endpoint provided access toCVE-2024-398947.5OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an ObsCVE-2024-398956.5Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GrCVE-2024-398965.3Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local autCVE-2024-398974.3zot is an OCI image registry. Prior to 2.1.0, the cache driver `GetBlob()` allows read access to any blob without access control check. If aCVE-2024-398995.3PrivateBin is an online pastebin where the server has zero knowledge of pasted data. In v1.5, PrivateBin introduced the YOURLS server-side pCVE-2024-39905.4The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover WidgCVE-2024-399005.4OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reportin