CVE-2024-38640

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A cross-site scripting (XSS) vulnerability has been reported to affect Download Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network.

We have already fixed the vulnerability in the following version: Download Station 5.8.6.283 ( 2024/06/21 ) and later

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-386417.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-386427.8An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local netw CVE-2024-386439.8A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability co CVE-2024-386448.8An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authen CVE-2024-386456.5A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow CVE-2024-386466.0An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulner CVE-2024-386477.5An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow rem CVE-2024-386485.7A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including u CVE-2024-386497.5An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at CVE-2024-38658.1Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-386509.9An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.CVE-2024-386518.5A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code executi