CVE-2024-45356

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

A unauthorized access vulnerability exists in the Xiaomi phone framework. The vulnerability is caused by improper validation and can be exploited by attackers to Access sensitive methods.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-45365.3In Eclipse Dataspace Components from version 0.2.1 to 0.6.2, in the EDC Connector component ( https://github.com/eclipse-edc/Connector ), an CVE-2024-453616.5A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and CVE-2024-453666.1Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script ma CVE-2024-453679.1The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenti CVE-2024-453688.8The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, ther CVE-2024-453698.1The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.CVE-2024-45377.5IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download CVE-2024-453707.3An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A speciall CVE-2024-453716.7Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated us CVE-2024-453726.5MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in CVE-2024-453738.8Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.CVE-2024-453746.5The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption ke