CVE-2024-42007

MediumCVSS 5.8/10Last modified Jun 17, 2026

Description

SPX (aka php-spx) through 0.4.15 allows SPX_UI_URI Directory Traversal to read arbitrary files.

Metrics

CVSS 3.1 5.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-22CWE-548

Affected software

VendorProductVersions
n/an/an/a
noisebynorthwestphp-spx<= 0.4.15

References

Timeline

Published
Jul 26, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-420089.3A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attCVE-2024-420099.3A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails ofCVE-2024-42014.4A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting frCVE-2024-420107.5mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in renCVE-2024-420117.5The Spotify app 8.9.58 for iOS has a buffer overflow in its use of strcat.CVE-2024-420125.7GRAU DATA Blocky before 3.1 stores passwords encrypted rather than hashed. At the login screen, the user's password is compared to the user'CVE-2024-420136.4In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows admCVE-2024-4201710.0An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenarCVE-2024-420187.7An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved CVE-2024-420198.0A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user intCVE-2024-42028.6In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiatiCVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.
CVE-2024-42007: Medium severity, CVSS 5.8 | Vulnix