CVE-2024-37161

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-371625.3zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stac CVE-2024-371637.5SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecure CVE-2024-371648.5Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply cu CVE-2024-371656.1Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulne CVE-2024-371668.9ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code CVE-2024-371674.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that th CVE-2024-371685.3@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8 CVE-2024-371695.3@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses CVE-2024-37177.5The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions CVE-2024-371715.0SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a CVE-2024-371725.4SAP S/4HANA Finance (Advanced Payment Management) does not perform necessary authorization check for an authenticated user, resulting in esc CVE-2024-371736.1Due to insufficient input validation, SAP CRM WebClient UI allows an unauthenticated attacker to craft a URL link which embeds a malicio