CVE-2024-11310

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23 CWE-22

Affected software

Vendor	Product	Versions
TRCore	DVC	>= 6.0, <= 6.3
trcore	dvc	>= 6.0, <= 6.3

References

https://www.twcert.org.tw/en/cp-139-8245-ad7d7-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8244-c45b5-1.htmlThird Party Advisory

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-113119.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113129.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113139.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113149.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113159.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113167.5Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - E CVE-2024-1131710.0Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeo CVE-2024-113187.5An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could CVE-2024-113194.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-c CVE-2024-11328.1A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to constru CVE-2024-113209.8Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue CVE-2024-113215.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Manageme