CVE-2024-37351

LowCVSS 3.4/10Last modified Jun 17, 2026

Description

There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06. Attackers with system administrator permissions can interfere with other system administrator’s use of the management UI when the second administrator later edits the same management object. This vulnerability is distinct from CVE-2024-37348 and CVE-2024-37349. The scope is unchanged, there is no loss of confidentiality. Impact to system integrity is high, impact to system availability is none.

Metrics

CVSS 3.1 3.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 20, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-373523.4There is a cross-site scripting vulnerability in the management UI of Absolute Secure Access prior to version 13.06 that allows attackers wi CVE-2024-373544.7In the Linux kernel, the following vulnerability has been resolved: btrfs: fix crash on racing fsync and size-extending write into prealloc CVE-2024-373558.8Improper access control in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via CVE-2024-373565.5In the Linux kernel, the following vulnerability has been resolved: tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). In dctcp_update_CVE-2024-373577.2A buffer overflow vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HT CVE-2024-373587.5Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and CVE-2024-373598.6The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficie CVE-2024-37367.5A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. It has been declared as problematic. Affected by this vulnerability is the func CVE-2024-373604.4Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2024-373619.9The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi CVE-2024-373626.3The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception CVE-2024-373636.5The product does not perform an authorization check when an actor attempts to access a resource or perform an action. (CWE-862) Hitac