CVE-2024-4310

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the page, resulting in a session takeover.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Ofofonobs	HubBank	1.0.2
ofofonobs	hubbank	1.0.2

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbankThird Party Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hubbankThird Party Advisory

Timeline

Published: Apr 29, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-431015.3Improper access control for some Intel(R) Data Center GPU Flex Series for Windows driver software before version 31.0.101.4255 may allow an CVE-2024-4310210.0Concurrent removals of certain anonymous shared memory mappings by using the UMTX_SHM_DESTROY sub-request of UMTX_OP_SHM can lead to decreas CVE-2024-431054.3Mattermost Plugin Channel Export versions <=1.0.0 fail to restrict concurrent runs of the /export command which allows a user to consume exc CVE-2024-431069.1A library injection vulnerability exists in Microsoft Excel 16.83 for macOS. A specially crafted library can leverage Excel's access privile CVE-2024-431077.2Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. alarm e CVE-2024-431086.5The goTenna Pro ATAK Plugin uses AES CTR type encryption for short, encrypted messages without any additional integrity checking mechanisms CVE-2024-43115.4zenml-io/zenml version 0.56.4 is vulnerable to an account takeover due to the lack of rate-limiting in the password change function. An atta CVE-2024-431108.8The ctl_request_sense function could expose up to three bytes of the kernel heap to userspace. Malicious software running in a guest VM tha CVE-2024-431116.1Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Fi CVE-2024-431126.1Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129 CVE-2024-431136.1The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129 CVE-2024-431147.8In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions