CVE-2024-25661

HighCVSS 7.7/10Last modified Jun 17, 2026

Description

In Infinera TNMS (Transcend Network Management System) 19.10.3, cleartext storage of sensitive information in memory of the desktop application TNMS Client allows guest OS administrators to obtain various users' passwords by reading memory dumps of the desktop application.

Metrics

CVSS 3.1 7.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-256626.1Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious CVE-2024-25671.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in jurecapuder AndroidWeatherApp 1.0.0 on An CVE-2024-256736.1Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.CVE-2024-256749.8An issue was discovered in MISP before 2.4.184. Organisation logo upload is insecure because of a lack of checks for the file extension and CVE-2024-256759.8An issue was discovered in MISP before 2.4.184. A client does not need to use POST to start an export generation process. This is related to CVE-2024-256764.7An issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leads CVE-2024-256778.8In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin CVE-2024-256789.8In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.CVE-2024-256796.5In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se CVE-2024-25687.2A vulnerability has been found in heyewei JFinalCMS 5.0.0 and classified as critical. Affected by this vulnerability is an unknown functiona CVE-2024-25699.8A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some u CVE-2024-256904.7There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.1 and below that may allow a remote, unauthenticated attacker