CVE-2024-28200

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2.

This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the wild.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288 CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Jul 1, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-28214.3A vulnerability, which was classified as problematic, has been found in DedeCMS 5.7. Affected by this issue is some unknown functionality of CVE-2024-282119.8nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMI CVE-2024-282129.8nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.CVE-2024-282139.8nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbi CVE-2024-282142.7nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.CVE-2024-282157.5nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause o CVE-2024-282165.4nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause o CVE-2024-282195.9In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.CVE-2024-28224.3A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_edit CVE-2024-282229.8In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an u CVE-2024-282246.6Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauth CVE-2024-282267.5in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input.