CVE-2024-3911

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can deceive users into performing unintended actions due to improper restriction of rendered UI layers or frames.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

No affected versions have been published.

Timeline

Published
Apr 23, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-391185.5Mommy Heather Advanced Backups up to v3.5.3 allows attackers to write arbitrary files via restoring a crafted back up.CVE-2024-391195.4idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/info_deal.php?mudi=rev&nohrefStr=close.CVE-2024-39129.8Certain models of ASUS routers have an arbitrary firmware upload vulnerability. An unauthenticated remote attacker can exploit this vulnerabCVE-2024-391235.4In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizCVE-2024-391245.4In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.CVE-2024-391255.4Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.CVE-2024-391265.4Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.CVE-2024-391295.3Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /sCVE-2024-39135.9An unauthenticated remote attacker can use this vulnerability to change the device configuration due to a file writeable for short time afteCVE-2024-391307.5A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream(CVE-2024-391326.5A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyCommaCVE-2024-391334.3Heap Buffer Overflow vulnerability in zziplib v0.13.77 allows attackers to cause a denial of service via the __zzip_parse_root_directory() f
CVE-2024-3911: Medium severity, CVSS 6.5 | Vulnix