CVE-2024-27311

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Jul 17, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-273128.1Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin a CVE-2024-273134.6Zoho ManageEngine PAM360 is vulnerable to Stored XSS vulnerability. This vulnerability is applicable only in the version 6610.CVE-2024-273142.4Zoho ManageEngine ServiceDesk Plus versions below 14730, ServiceDesk Plus MSP below 14720 and SupportCenter Plus below 14720 are vulnerable CVE-2024-273154.3An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement CVE-2024-273167.5HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a CVE-2024-273179.9In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted CVE-2024-273187.5Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor prot CVE-2024-273199.1Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions CVE-2024-27325.4The Themify Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'themify_post_slider shortcode in CVE-2024-273207.8An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classifi CVE-2024-273217.8An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilab CVE-2024-273228.8Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not includ