CVE-2024-45361

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A protocol flaw vulnerability exists in the Xiaomi Mi Connect Service APP. The vulnerability is caused by the validation logic is flawed and can be exploited by attackers to leak sensitive user information.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-453666.1Welcart e-Commerce prior to 2.11.2 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script ma CVE-2024-453679.1The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenti CVE-2024-453688.8The H2-DM1E PLC's authentication protocol appears to utilize either a custom encoding scheme or a challenge-response protocol. However, ther CVE-2024-453698.1The web application uses a weak authentication mechanism to verify that a request is coming from an authenticated and authorized resource.CVE-2024-45377.5IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain the download CVE-2024-453707.3An authentication bypass vulnerability exists in the User profile management functionality of Socomec Easy Config System 2.6.1.0. A speciall CVE-2024-453716.7Improper access control for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6077 may allow an authenticated us CVE-2024-453726.5MZK-DP300N firmware versions 1.04 and earlier contains a cross-site request forger vulnerability. Viewing a malicious page while logging in CVE-2024-453738.8Once logged in to ProGauge MAGLINK LX4 CONSOLE, a valid user can change their privileges to administrator.CVE-2024-453746.5The goTenna Pro ATAK plugin uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption ke CVE-2024-45387.5IDOR vulnerability in Janto Ticketing Software affecting version 4.3r10. This vulnerability could allow a remote user to obtain a user's eve CVE-2024-453825.5in OpenHarmony v4.1.0 and prior versions allow a local attacker cause DOS through out-of-bounds write.