CVE-2024-46480

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

An NTLM hash leak in Venki Supravizio BPM up to 18.0.1 allows authenticated attackers with Application Administrator access to escalate privileges on the underlying host system.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Venki	Supravizio BPM	<= 18.0.1

References

https://github.com/Lorenzo-de-Sa/Vulnerability-ResearchThird Party Advisory
https://github.com/Lorenzo-de-Sa/Vulnerability-Research/blob/main/CVE-2024-46480.mdThird Party Advisory
https://www.venki.com.br/ferramenta-bpm/supravizio/Product

Timeline

Published: Jan 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-464816.1The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.CVE-2024-464828.2An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to CVE-2024-464839.8Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov CVE-2024-464849.8TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.CVE-2024-464856.3dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=addCate CVE-2024-464868.0TP-LINK TL-WDR5620 v2.3 was discovered to contain a remote code execution (RCE) vulnerability via the httpProcDataSrv function.CVE-2024-464885.5sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function. This vulnerability allows attackers to c CVE-2024-464898.8A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL.CVE-2024-46496.1A vulnerability classified as problematic has been found in Campcodes Complete Web-Based School Management System 1.0. This affects an unkno CVE-2024-464945.4A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload CVE-2024-46506.1A vulnerability classified as problematic was found in Campcodes Complete Web-Based School Management System 1.0. This vulnerability affects CVE-2024-465059.1Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities.