CVE-2024-33647

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected application lacks proper access controls. This could allow an authenticated user to query items beyond the user's allowed projects.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-336486.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews rec CVE-2024-336496.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allo CVE-2024-33655.4A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown pro CVE-2024-336504.3Cross-Site Request Forgery (CSRF) vulnerability in Cryout Creations Serious Slider.This issue affects Serious Slider: from n/a through 1.2.4 CVE-2024-336518.8Cross-Site Request Forgery (CSRF) vulnerability in Matthew Fries MF Gig Calendar.This issue affects MF Gig Calendar : from n/a through 1.2.1 CVE-2024-336525.3Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1.CVE-2024-336537.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past CVE-2024-336547.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past CVE-2024-336557.5The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS qu CVE-2024-336567.8The DXE module SmmComputrace contains a vulnerability that allows local attackers to leak stack or global memory. This could lead to privile CVE-2024-336577.8This SMM vulnerability affects certain modules, allowing privileged attackers to execute arbitrary code, manipulate stack memory, and leak i CVE-2024-336587.8APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Restriction of Operations within the Bounds of a Memory Buff