CVE-2024-27123

MediumCVSS 5.2/10Last modified Sep 28, 2026

Description

A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to bypass security mechanisms or read application data.

We have already fixed the vulnerability in the following version: QcalAgent 1.1.9 and later

Metrics

CVSS 4.0 5.2/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2026
Last modified: Sep 28, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-271247.5An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-271254.8A cross-site scripting (XSS) vulnerability has been reported to affect Helpdesk. If exploited, the vulnerability could allow authenticated a CVE-2024-271265.4A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenti CVE-2024-271278.8A double free vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow CVE-2024-271288.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-271298.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-27136.5A vulnerability, which was classified as critical, was found in Campcodes Complete Online DJ Booking System 1.0. Affected is an unknown func CVE-2024-271308.8A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-271329.6Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. This issue leads to a client-side RCE when running an un CVE-2024-271339.6Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. This issue leads to a client-side RCE CVE-2024-271347.0Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udf. This behavior can be exploited by a loca CVE-2024-271359.9Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar F