CVE-2024-38274

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 18, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-382757.5The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could beCVE-2024-382768.8Incorrect CSRF token checks resulted in multiple CSRF risks.CVE-2024-382775.4A unique key should be generated for a user's QR login key and their auto-login key, so the same key cannot be used interchangeably between CVE-2024-382786.6A vulnerability has been identified in RUGGEDCOM RMC8388 V5.X (All versions < V5.9.0), RUGGEDCOM RMC8388NC V5.X (All versions < V5.9.0), RUGCVE-2024-382794.6The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain accesCVE-2024-38288.8The Spectra Pro plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.1.5. This is due to the pCVE-2024-382804.6An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product CVE-2024-382819.8An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.CVE-2024-382828.5Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the opeCVE-2024-382835.1Sensitive customer information is stored in the device without encryption.CVE-2024-382848.7Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicCVE-2024-382857.0Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.
CVE-2024-38274: Medium severity, CVSS 6.1 | Vulnix