CVE-2024-39703

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafted request to an API endpoint.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
ThreatQuotientThreatQ< 5.29.3

References

Timeline

Published
Dec 18, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-397049.8Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary codeCVE-2024-397059.8NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download funCVE-2024-397075.3Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could leCVE-2024-397087.0An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. SometimCVE-2024-397097.8Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version CVE-2024-39714.3The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to maCVE-2024-397109.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rCVE-2024-397119.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a CVE-2024-397129.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a rCVE-2024-397138.6A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.CVE-2024-397149.9A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution CVE-2024-397158.5A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC
CVE-2024-39703: High severity, CVSS 8.8 | Vulnix