CVE-2024-37774

HighCVSS 8.0/10Last modified Jul 5, 2026

Description

A Cross-Site Request Forgery (CSRF) in Sunbird DCIM dcTrack v9.1.2 allows authenticated attackers to escalate their privileges by forcing an Administrator user to perform sensitive requests in some admin screens.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Dec 16, 2024
Last modified
Jul 5, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-377757.5Incorrect access control in Sunbird DCIM dcTrack v9.1.2 allows attackers to create or update a ticket with a location which bypasses an RBACCVE-2024-377764.8A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crCVE-2024-377778.8O2OA v9.0.3 was discovered to contain a remote code execution (RCE) vulnerability via the mainOutput() function.CVE-2024-377798.8WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant scriptCVE-2024-37787.2The file upload functionality of Ai3 QbiBot does not properly restrict types of uploaded files, allowing remote attackers with administratorCVE-2024-377829.8An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or exeCVE-2024-377835.4A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inject malicious JavaScriCVE-2024-37795.5Denial of service vulnerability present shortly after product installation or upgrade, potentially allowed an attacker to render ESET’s secuCVE-2024-377916.0DuxCMS3 v3.1.3 was discovered to contain a SQL injection vulnerability via the keyword parameter at /article/Content/index?class_id.CVE-2024-377947.5Improper input validation in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT2 input file.CVE-2024-377957.5A segmentation fault in CVC5 Solver v1.1.3 allows attackers to cause a Denial of Service (DoS) via a crafted SMT-LIB input file containing tCVE-2024-377985.9Cross-site scripting (XSS) vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 all
CVE-2024-37774: High severity, CVSS 8.0 | Vulnix