CVE-2024-41940

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly validate user input to a privileged command queue. This could allow an authenticated attacker to execute OS commands with elevated privileges.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Aug 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-419414.3A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application does not properly enforce authorization che CVE-2024-419427.2JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to versions 4.1.6 and 5.1.0, if a user is CVE-2024-419434.6I, Librarian is an open-source version of a PDF managing SaaS. PDF notes are displayed on the Item Summary page without any form of validati CVE-2024-419446.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `report/data/proofofplayReport` API route in CVE-2024-419453.1fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactio CVE-2024-419467.5REXML is an XML toolkit for Ruby. The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX CVE-2024-419475.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another CVE-2024-419485.0biscuit-java is the java implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-419496.4biscuit-rust is the Rust implementation of Biscuit, an authentication and authorization token for microservices architectures. Third-party b CVE-2024-41952.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authent CVE-2024-419507.5Haystack is an end-to-end LLM framework that allows you to build applications powered by LLMs, Transformer models, vector search and more. H CVE-2024-419514.4Pheonix App is a Python application designed to streamline various tasks, from managing files to playing mini-games. The issue is that the m