CVE-2024-21525

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the source data not being checked. Creating a new twain.TwainSDK with a productName or productFamily, manufacturer, version.info property of length >= 34 chars leads to a buffer overflow vulnerability.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-703

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-215267.5All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertyCVE-2024-215278.2Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenbergCVE-2024-215285.9All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to improCVE-2024-215298.2Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. CVE-2024-21539.8A vulnerability, which was classified as critical, was found in SourceCodester Online Mobile Management Store 1.0. This affects an unknown pCVE-2024-215304.5Versions of the package cocoon before 0.4.0 are vulnerable to Reusing a Nonce, Key Pair in Encryption when the encrypt, wrap, and dump functCVE-2024-215315.3All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the proCVE-2024-215327.3All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bCVE-2024-215336.5All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL CVE-2024-215349.8All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can CVE-2024-215356.1Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper inputCVE-2024-215367.5Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an
CVE-2024-21525: High severity, CVSS 8.3 | Vulnix