CVE-2024-39709

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

No affected versions have been published.

Timeline

Published: Nov 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-39714.3The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to ma CVE-2024-397109.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r CVE-2024-397119.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a CVE-2024-397129.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r CVE-2024-397138.6A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.CVE-2024-397149.9A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution CVE-2024-397158.5A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC CVE-2024-397177.2The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user log CVE-2024-397188.1An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival CVE-2024-397197.5An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route wit CVE-2024-39724.3The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which CVE-2024-397208.2An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 byt