CVE-2024-37347

LowCVSS 3.4/10Last modified Jun 17, 2026

Description

There is a cross-site scripting vulnerability in the pool configuration component of the management UI of Absolute Secure Access prior to 13.06. Attackers with system administrator permissions can pass a limited length script to be run by another administrator. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Absolute Software	Secure Access	< 13.06

References

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-373483.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system a CVE-2024-373493.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system a CVE-2024-37353.7A vulnerability was found in Smart Office up to 20240405. It has been classified as problematic. Affected is an unknown function of the file CVE-2024-373504.7There is a cross-site scripting vulnerability in the policy management UI of Absolute Secure Access prior to version 13.06. Attackers can in CVE-2024-373513.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system a CVE-2024-373523.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers wi CVE-2024-373544.7In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc CVE-2024-373558.8Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via CVE-2024-373565.5In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_CVE-2024-373577.2A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT CVE-2024-373587.5Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and CVE-2024-373598.6The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficie