CVE-2024-47604

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

NuGet Gallery is a package repository that powers nuget.org. The NuGetGallery has a security vulnerability in its handling of HTML element attributes, which allows an attacker to execute arbitrary HTML or Javascript code in a victim's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Oct 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-476055.4silverstripe-asset-admin is a silverstripe assets gallery for asset management. When using the "insert media" functionality, the linked oEmb CVE-2024-476069.8GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function qtdemux_CVE-2024-476079.8GStreamer is a library for constructing graphs of media-handling components. stack-buffer overflow has been detected in the gst_opus_dec_pa CVE-2024-476089.8Logicytics is designed to harvest and collect data for forensic analysis. Logicytics has a basic vuln affecting compromised devices from she CVE-2024-476096.9Tonic is a native gRPC client & server implementation with async/await support. When using tonic::transport::Server there is a remote DoS at CVE-2024-47618.8Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a CVE-2024-476105.4InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store jav CVE-2024-476116.3XZ Utils provide a general-purpose data-compression library plus command-line tools. When built for native Windows (MinGW-w64 or MSVC), the CVE-2024-476123.5DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table CVE-2024-476139.8GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in CVE-2024-476147.5async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a fie CVE-2024-476159.8GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis