CVE-2024-37742

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share clipboard data between the SEB kiosk mode and the underlying system, compromising exam integrity. By exploiting this flaw, an attacker can bypass exam controls and gain an unfair advantage during exams.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-377439.8An issue in mmzdev KnowledgeGPT V.0.0.5 allows a remote attacker to execute arbitrary code via the Document Display Component.CVE-2024-37757.5aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attac CVE-2024-377588.8Improper access control in the endpoint /RoleMenuMapping/AddRoleMenu of Digiteam v4.21.0.0 allows authenticated attackers to escalate privil CVE-2024-377599.8DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Vi CVE-2024-37766.1The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can in CVE-2024-377629.9MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.CVE-2024-377635.4MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can vie CVE-2024-377645.4MachForm up to version 19 is affected by an authenticated stored cross-site scripting.CVE-2024-377658.8Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.CVE-2024-377677.5Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET req CVE-2024-377689.114Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.CVE-2024-377698.8Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.