CVE-2024-1474

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

In WS_FTP Server versions before 8.8.5, reflected cross-site scripting issues have been identified on various user supplied inputs on the WS_FTP Server administrative interface.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Feb 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-14755.3The Coming Soon Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, CVE-2024-14765.3The Under Construction / Maintenance Mode from Acurax plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u CVE-2024-14775.3The Easy Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.2 v CVE-2024-14785.3The Maintenance Mode plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.1 via th CVE-2024-14795.3The WP Show Posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 via the w CVE-2024-14807.5Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.CVE-2024-14815.3A flaw was found in FreeIPA. This issue may allow a remote attacker to craft a HTTP request with parameters that can be interpreted as comma CVE-2024-14826.5An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed an attacker to create new branches in publi CVE-2024-14837.5A path traversal vulnerability exists in mlflow/mlflow version 2.9.2, allowing attackers to access arbitrary files on the server. By craftin CVE-2024-14846.1The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the date CVE-2024-14859.3A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks CVE-2024-14867.4Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices