CVE-2024-3850

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be exploited, so the scope and severity is limited. Also, even if JavaScript is executed, no additional benefits are obtained.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-385016.1An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-priCVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential explCVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articlesCVE-2024-385057.5In JetBrains YouTrack before 2024.2.34646 user access token was sent to the third-party siteCVE-2024-385068.1In JetBrains YouTrack before 2024.2.34646 user without appropriate permissions could enable the auto-attach option for workflowsCVE-2024-385075.4In JetBrains Hub before 2024.2.34646 stored XSS via project description was possibleCVE-2024-385087.2A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an aCVE-2024-385097.2A privilege escalation vulnerability was discovered in XCC that could allow an authenticated XCC user with elevated privileges to execute arCVE-2024-38515.4A stored Cross-Site Scripting (XSS) vulnerability exists in the 'imartinez/privategpt' repository due to improper validation of file uploadsCVE-2024-385107.2A privilege escalation vulnerability was discovered in the SSH captive command shell interface that could allow an authenticated XCC user wiCVE-2024-385117.2A privilege escalation vulnerability was discovered in an upload processing functionality of XCC that could allow an authenticated XCC user