CVE-2024-11978

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-36

Affected software

VendorProductVersions
InterinfoDreamMaker< 2024/09/26
interinfodreammaker0

References

Timeline

Published
Nov 29, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-119799.8DreamMaker from Interinfo has a Path Traversal vulnerability and does not restrict the types of uploaded files. This allows unauthenticated CVE-2024-11989.8A vulnerability, which was classified as critical, was found in openBI up to 6.0.3. Affected is the function addxinzhi of the file applicatiCVE-2024-119808.6Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to dirCVE-2024-119817.5Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive conCVE-2024-119827.2Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator priCVE-2024-119837.2Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privCVE-2024-119848.8A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.1CVE-2024-119854.4An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router ImprCVE-2024-119869.6Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an AdministCVE-2024-11997.5A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerabilitCVE-2024-119904.6A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate CVE-2024-119916.5Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few
CVE-2024-11978: High severity, CVSS 7.5 | Vulnix