CVE-2024-24768

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-315 CWE-311

Affected software

No affected versions have been published.

Timeline

Published: Feb 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-247692.1vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, users can reset their MFA token via API r CVE-2024-24775.4The wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of an uploaded image in all CVE-2024-247705.3vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Par CVE-2024-247715.9Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-fac CVE-2024-247724.3A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying CVE-2024-247736.5Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue af CVE-2024-247744.1Mattermost Jira Plugin handling subscriptions fails to check the security level of an incoming issue or limit it based on the user who creat CVE-2024-247757.5When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic can cause the Traffic Management Micro CVE-2024-247764.3Mattermost fails to check the required permissions in the POST /api/v4/channels/stats/member_count API resulting in channel member counts be CVE-2024-247778.8A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially CVE-2024-247786.5Improper privilege management in a REST interface allowed registered users to access unauthorized resources if the resource ID was know. CVE-2024-247796.5Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create vi