CVE-2024-10093

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the file ConvertXtoDvd.exe. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
VSO	ConvertXtoDvd	7.0.0.83
vso	convertxtodvd	7.0.0.83

References

https://vuldb.com/?ctiid.280758Permissions Required
https://vuldb.com/?id.280758Third Party Advisory
https://vuldb.com/?submit.420798Third Party Advisory

Timeline

Published: Oct 17, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-100949.8Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code CVE-2024-100959.8In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserializat CVE-2024-100978.1The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9 CVE-2024-100982.7The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated user CVE-2024-100996.1A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occ CVE-2024-10105.4A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of t CVE-2024-101007.5A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file p CVE-2024-101015.4A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file en CVE-2024-101022.7The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery setti CVE-2024-101036.1In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on CVE-2024-101045.9The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users suc CVE-2024-101055.9The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users su