CVE-2024-28212

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

VendorProductVersions
NAVERnGrinder—
naverngrinder< 3.5.9

References

Timeline

Published
Mar 7, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-282139.8nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbiCVE-2024-282142.7nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.CVE-2024-282157.5nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause oCVE-2024-282165.4nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause oCVE-2024-282195.9In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.CVE-2024-28224.3A vulnerability, which was classified as problematic, was found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/vote_editCVE-2024-282229.8In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an uCVE-2024-282246.6Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthCVE-2024-282267.5in OpenHarmony v4.0.0 and prior versions allow a remote attacker cause DOS through improper input.CVE-2024-282285.3In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleCVE-2024-282296.5In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articlesCVE-2024-28234.3A vulnerability has been found in DedeCMS 5.7 and classified as problematic. This vulnerability affects unknown code of the file /src/dede/m
CVE-2024-28212: Critical severity, CVSS 9.8 | Vulnix