First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2024-10094

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Pega Platform versions 6.x to Infinity 24.1.1 are affected by an issue with Improper Control of Generation of Code

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Pegasystems	Pega Infinity	>= 6.1, < 24.1.2
pegasystems	pega_infinity	>= 6.1, < 24.1.2

References

https://support.pega.com/support-doc/pega-security-advisory-d24-vulnerability-remediation-noteVendor Advisory

Timeline

Published: Nov 20, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-100959.8In Progress Telerik UI for WPF versions prior to 2024 Q4 (2024.4.1213), a code execution attack is possible through an insecure deserializat CVE-2024-100978.1The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9 CVE-2024-100982.7The ApplyOnline WordPress plugin before 2.6.3 does not protect uploaded files during the application process, allowing unauthenticated user CVE-2024-100996.1A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occ CVE-2024-10105.4A vulnerability classified as problematic has been found in SourceCodester Employee Management System 1.0. This affects an unknown part of t CVE-2024-101007.5A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file p CVE-2024-101015.4A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file en CVE-2024-101022.7The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its Gallery setti CVE-2024-101036.1In the process of testing the MailPoet WordPress plugin before 5.3.2, a vulnerability was found that allows you to implement Stored XSS on CVE-2024-101045.9The Jobs for WordPress plugin before 2.7.8 does not sanitise and escape some of its Job settings, which could allow high privilege users suc CVE-2024-101055.9The Job Postings WordPress plugin before 2.7.11 does not sanitise and escape some of its settings, which could allow high privilege users su CVE-2024-101063.7A buffer overflow vulnerability in the packet handoff plugin allows an attacker to overwrite memory outside the plugin's buffer.