CVE-2024-11311

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote attackers to upload arbitrary files to any directory, leading to arbitrary code execution by uploading webshells.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23 CWE-434 CWE-22

Affected software

Vendor	Product	Versions
TRCore	DVC	>= 6.0, <= 6.3
trcore	dvc	>= 6.0, <= 6.3

References

https://www.twcert.org.tw/en/cp-139-8247-83457-2.htmlThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-8246-d462a-1.htmlThird Party Advisory

Timeline

Published: Nov 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-113129.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113139.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113149.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113159.8The DVC from TRCore has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated remote CVE-2024-113167.5Fileszie Check vulnerabilities allow a malicious user to bypass size limits or overload to the product. Affected products: ABB ASPECT - E CVE-2024-1131710.0Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an opportunity for session takeo CVE-2024-113187.5An IDOR (Insecure Direct Object Reference) vulnerability has been discovered in AbsysNet, affecting version 2.3.1. This vulnerability could CVE-2024-113194.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-c CVE-2024-11328.1A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to constru CVE-2024-113209.8Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue CVE-2024-113215.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Manageme CVE-2024-113227.5A denial-of-service vulnerability exists in CyberPower PowerPanel Business (PPB) 4.11.0. An unauthenticated remote attacker can restart the