CVE-2024-38642

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compromise the security of the system via unspecified vectors.

We have already fixed the vulnerability in the following version: QuMagie 2.3.1 and later

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Sep 6, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-386439.8A missing authentication for critical function vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability co CVE-2024-386448.8An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authen CVE-2024-386456.5A server-side request forgery (SSRF) vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow CVE-2024-386466.0An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulner CVE-2024-386477.5An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow rem CVE-2024-386485.7A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including u CVE-2024-386497.5An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at CVE-2024-38658.1Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-386509.9An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.CVE-2024-386518.5A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code executi CVE-2024-386529.1Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of serv CVE-2024-386537.5XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.