CVE-2024-29010

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The XML document processed in the GMS ECM URL endpoint is vulnerable to XML external entity (XXE) injection, potentially resulting in the disclosure of sensitive information.

This issue affects GMS: 9.3.4 and earlier versions.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published
May 1, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-290117.5Use of hard-coded password in the GMS ECM endpoint leading to authentication bypass vulnerability. This issue affects GMS: 9.3.4 and earlieCVE-2024-290127.5Stack-based buffer overflow vulnerability in the SonicOS HTTP server allows an authenticated remote attacker to cause Denial of Service (DoSCVE-2024-290136.5Heap-based buffer overflow vulnerability in the SonicOS SSL-VPN allows an authenticated remote attacker to cause Denial of Service (DoS) viaCVE-2024-290148.8Vulnerability in SonicWall SMA100 NetExtender Windows (32 and 64-bit) client 10.2.339 and earlier versions allows an attacker to arbitrary cCVE-2024-290157.8Uncontrolled search path in some Intel(R) VTune(TM) Profiler software before versions 2024.1 may allow an authenticated user to potentially CVE-2024-290187.5Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container toCVE-2024-290198.1ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome veCVE-2024-29028.8A vulnerability was found in Tenda AC7 15.03.06.44 and classified as critical. This issue affects the function fromSetWifiGusetBasic of the CVE-2024-290205.3JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitivCVE-2024-290219.0Judge0 is an open-source online code execution system. The default configuration of Judge0 leaves the service vulnerable to a sandbox escapeCVE-2024-290228.8Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versioCVE-2024-290237.2Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. Session tokens are