CVE-2024-42013

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

In GRAU DATA Blocky before 3.1, Blocky-Gui has a Client-Side Enforcement of Server-Side Security vulnerability. An attacker with Windows administrative or debugging privileges can patch a binary in memory or on disk to bypass the password login requirement and gain full access to all functions of the program.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jan 22, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-4201710.0An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In the worst-case scenar CVE-2024-420187.7An issue was discovered in Atos Eviden SMC xScale before 1.6.6. During initialization of nodes, some configuration parameters are retrieved CVE-2024-420198.0A vulnerability that allows an attacker to access the NTLM hash of the Veeam Reporter Service service account. This attack requires user int CVE-2024-42028.6In Progress® Telerik® Reporting versions prior to 2024 Q2 (18.1.24.514), a code execution attack is possible through an insecure instantiati CVE-2024-420205.4A Cross-site-scripting (XSS) vulnerability exists in the Reporter Widgets that allows HTML injection.CVE-2024-420216.5An improper access control vulnerability allows an attacker with valid access tokens to access saved credentials.CVE-2024-420225.3An incorrect permission assignment vulnerability allows an attacker to modify product configuration files.CVE-2024-420238.8An improper access control vulnerability allows low-privileged users to execute code with Administrator privileges remotely.CVE-2024-420248.8A vulnerability that allows an attacker in possession of the Veeam ONE Agent service account credentials to perform remote code execution on CVE-2024-420257.8A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and ea CVE-2024-420276.7The E2EE password entropy generated by Rocket.Chat Mobile prior to version 4.5.1 is insufficient, allowing attackers to crack it if they hav CVE-2024-420288.8A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and ea