CVE-2024-45288

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

A missing null-termination character in the last element of an nvlist array string can lead to writing outside the allocated buffer.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-170CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 5, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-452897.5The fetch(3) library uses environment variables for passing certain information, including the revocation file pathname. The environment vaCVE-2024-45295.0The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in useCVE-2024-452907.5PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file whicCVE-2024-452918.8PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file thatCVE-2024-452925.4PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "jCVE-2024-452937.5PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. The security scanner responsible for preventing XXE attacks CVE-2024-452948.6The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities (including validator), for the Fast HealtCVE-2024-452967.5path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be CVE-2024-452974.3Discourse is an open source platform for community discussion. Users can see topics with a hidden tag if they know the label/name of that taCVE-2024-452984.3Wiki.js is an open source wiki app built on Node.js. A disabled user can still gain access to a wiki by abusing the password reset function.CVE-2024-452996.5alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaCVE-2024-45306.3The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in use