CVE-2024-38646

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow local authenticated attackers who have gained administrator access to read or modify the resource.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.7 and later

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Nov 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-386477.5An exposure of sensitive information vulnerability has been reported to affect QNAP AI Core. If exploited, the vulnerability could allow rem CVE-2024-386485.7A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including u CVE-2024-386497.5An out-of-bounds write in IPsec of Ivanti Connect Secure before version 22.7R2.1(Not Applicable to 9.1Rx) allows a remote unauthenticated at CVE-2024-38658.1Memory safety bugs present in Firefox 124. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-386509.9An authentication bypass vulnerability can allow a low privileged attacker to access the NTLM hash of service account on the VSPC server.CVE-2024-386518.5A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code executi CVE-2024-386529.1Path traversal in the skin management component of Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to achieve denial of serv CVE-2024-386537.5XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.CVE-2024-386544.4Improper bounds checking in Ivanti Secure Access Client before version 22.7R3 allows a local authenticated attacker with admin privileges to CVE-2024-386557.2Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18 CVE-2024-386569.1Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a r CVE-2024-386574.9External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a r