CVE-2024-38516

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

ai-client-html is an Aimeos e-commerce HTML client component. Debug information revealed sensitive information from environment variables in error log. This issue has been patched in versions 2024.04.7, 2023.10.15, 2022.10.13 and 2021.10.22.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1295

Affected software

Vendor	Product	Versions
aimeos	ai-client-html	>= 2024.04.1, < 2024.04.7; >= 2023.04.1, < 2023.10.15; >= 2022.04.1, < 2022.10.13; >= 2021.10.1, < 2021.10.22

References

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-385177.8Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `inclu CVE-2024-385184.6BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to CVE-2024-385197.8`yt-dlp` and `youtube-dl` are command-line audio/video downloaders. Prior to the fixed versions, `yt-dlp` and `youtube-dl` do not limit the CVE-2024-38527.5GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox < 125, Fire CVE-2024-385205.3SoftEtherVPN is a an open-source cross-platform multi-protocol VPN Program. When SoftEtherVPN is deployed with L2TP enabled on a device, it CVE-2024-385216.1Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. There is a stored XSS in the Inbox. T CVE-2024-385226.3Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The CSP policy applied on the `tips.h CVE-2024-385237.5Hush Line is a free and open-source, anonymous-tip-line-as-a-service for organizations or individuals. The TOTP authentication flow has mult CVE-2024-385247.5GeoServer is an open source server that allows users to share and edit geospatial data. org.geowebcache.GeoWebCacheDispatcher.handleFrontPag CVE-2024-385257.5dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs t CVE-2024-385267.2pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io.CVE-2024-385275.4ZenUML is JavaScript-based diagramming tool that requires no server, using Markdown-inspired text definitions and a renderer to create and m