CVE-2024-25660

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

The WebDAV service in Infinera TNMS (Transcend Network Management System) 19.10.3 allows a low-privileged remote attacker to conduct unauthorized file operations, because of execution with unnecessary privileges.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256617.7In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop applicat CVE-2024-256626.1Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious CVE-2024-25671.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on An CVE-2024-256736.1Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.CVE-2024-256749.8An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and CVE-2024-256759.8An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to CVE-2024-256764.7An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads CVE-2024-256778.8In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin CVE-2024-256789.8In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.CVE-2024-256796.5In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se CVE-2024-25687.2A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functiona CVE-2024-25699.8A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some u