CVE-2024-37031

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Active Admin (aka activeadmin) framework before 3.2.2 for Ruby on Rails allows stored XSS in certain situations where users can create entities (to be later edited in forms) with arbitrary names, aka a "dynamic form legends" issue. 4.0.0.beta7 is also a fixed version.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-370328.8Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandles CVE-2024-370345.9An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the CVE-2024-370369.8CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass when sending a malformed POST request and pa CVE-2024-370378.1CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticate CVE-2024-370388.8CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface CVE-2024-370397.5CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially cra CVE-2024-37049.8SQL Injection Vulnerability has been found on OpenGnsys product affecting version 1.1.1d (Espeto). This vulnerability allows an attacker to CVE-2024-370408.1CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to CVE-2024-370417.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2024-370424.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-370434.9A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could all CVE-2024-370447.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,