CVE-2024-21866

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

No affected versions have been published.

Timeline

Published
Feb 2, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-218695.5In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. ThCVE-2024-21875.4The Beaver Builder Addons by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonials widget in all verCVE-2024-218704.9A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. ACVE-2024-218717.5Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privCVE-2024-218727.5The device allows an unauthenticated attacker to bypass authentication and modify the cookie to reveal hidden pages that allows more criticCVE-2024-218756.5Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 20CVE-2024-218769.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability via a URL parameter in Enphase IQ Gateway (formCVE-2024-218776.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability through a url parameter in Enphase IQ Gateway (CVE-2024-218789.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as ECVE-2024-218798.8Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticatCVE-2024-21886.1Cross-Site Scripting (XSS) vulnerability stored in TP-Link Archer AX50 affecting firmware version 1.0.11 build 2022052. This vulnerability cCVE-2024-218807.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated
CVE-2024-21866: Medium severity, CVSS 5.3 | Vulnix