CVE-2024-33615

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel

server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-336165.3Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. SharpCVE-2024-336175.9Insufficient control flow management in some Intel(R) QAT Engine for OpenSSL software before version v1.6.1 may allow information disclosureCVE-2024-336187.5Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk spCVE-2024-336195.5In the Linux kernel, the following vulnerability has been resolved: efi: libstub: only free priv.runtime_map when allocated priv.runtime_mCVE-2024-33628.8A vulnerability was found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this issue is some unknown funCVE-2024-336208.6Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the fCVE-2024-336215.5In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet CVE-2024-336226.5Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerabilitCVE-2024-336237.5A denial of service vulnerability exists in the Web Application functionality of LevelOne WBR-6012 R0.40e6. A specially crafted HTTP requestCVE-2024-336244.3Improper input validation for some Intel(R) PROSet/Wireless WiFi software for Windows before version 23.60 may allow an unauthenticated userCVE-2024-336259.8CyberPower PowerPanel business application code contains a hard-coded JWT signing key. This could result in an attacker forging JWT tokensCVE-2024-336265.3The LevelOne WBR-6012 router contains a vulnerability within its web application that allows unauthenticated disclosure of sensitive informa
CVE-2024-33615: High severity, CVSS 8.8 | Vulnix