CVE-2024-3776

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The parameter used in the login page of Netvision airPASS is not properly filtered for user input. An unauthenticated remote attacker can insert JavaScript code to the parameter for Reflected Cross-site scripting attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-377629.9MachForm up to version 21 is affected by an authenticated unrestricted file upload which leads to a remote code execution.CVE-2024-377635.4MachForm up to version 19 is affected by an unauthenticated stored cross-site scripting which affects users with valid sessions whom can vie CVE-2024-377645.4MachForm up to version 19 is affected by an authenticated stored cross-site scripting.CVE-2024-377658.8Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.CVE-2024-377677.5Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET req CVE-2024-377689.114Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.CVE-2024-377698.8Insecure permissions in 14Finger v1.1 allow attackers to escalate privileges from normal user to Administrator via a crafted POST request.CVE-2024-37779.8The password reset feature of Ai3 QbiBot lacks proper access control, allowing unauthenticated remote attackers to reset any user's password CVE-2024-377709.114Finger v1.1 was discovered to contain a remote command execution (RCE) vulnerability in the fingerprint function. This vulnerability allow CVE-2024-377734.8An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to inject arbitrary HTML code CVE-2024-377748.0A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an CVE-2024-377757.5Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBAC