CVE-2024-28878

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

IO-1020 Micro ELD downloads source code or an executable from an adjacent location and executes the code without sufficiently verifying the origin or integrity of the code.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-494

Affected software

No affected versions have been published.

Timeline

Published
Apr 12, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-28885.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldCVE-2024-288806.5Path traversal vulnerability in MosP kintai kanri V4.6.6 and earlier allows a remote attacker who can log in to the product to obtain sensitCVE-2024-288816.7Uncontrolled search path for some Intel(R) Fortran Compiler Classic software before version 2021.13 may allow an authenticated user to potenCVE-2024-288824.3OpenVPN from 2.6.0 through 2.6.10 in a server role accepts multiple exit notifications from authenticated clients which will extend the valiCVE-2024-288837.4An origin validation vulnerability exists in BIG-IP APM browser network access VPN client for Windows, macOS and Linux which may alloCVE-2024-288855.9Observable discrepancy in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosure via network aCVE-2024-288868.4OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file (.usCVE-2024-288877.8Uncontrolled search path in some Intel(R) IPP software before version 2021.11 may allow an authenticated user to potentially enable escalatiCVE-2024-288888.8A use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a checkbox field object. A specially crafted JavascripCVE-2024-288895.9When an SSL profile with alert timeout is configured with a non-default value on a virtual server, undisclosed traffic along with conditionsCVE-2024-28895.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-liCVE-2024-288905.3Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a
CVE-2024-28878: Critical severity, CVSS 9.6 | Vulnix