CVE-2024-48894

HighCVSS 7.5/10Last modified Sep 26, 2026

Description

A cleartext transmission vulnerability exists in the WEBVIEW-M functionality of Socomec DIRIS Digiware M-70 1.6.9. A specially crafted HTTP request can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-319

Affected software

No affected versions have been published.

Timeline

Published: Dec 1, 2025
Last modified: Sep 26, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-488958.8Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Rakuten Turbo 5G firmware version CVE-2024-488964.3A vulnerability was found in Moodle. It is possible for users with the "send message" capability to view other users' names that they may no CVE-2024-488974.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only edit or delete RSS feeds that they have permiss CVE-2024-488984.3A vulnerability was found in Moodle. Users with access to delete audiences from reports could delete audiences from other reports that they CVE-2024-488994.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only fetch the list of course badges for courses tha CVE-2024-48904.9A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerabi CVE-2024-489004.3A vulnerability was found in Moodle. Additional checks are required to ensure users with permission to view badge recipients can only access CVE-2024-489014.3A vulnerability was found in Moodle. Additional checks are required to ensure users can only access the schedule of a report if they have pe CVE-2024-489025.4In JetBrains YouTrack before 2024.3.46677 improper access control allowed users with project update permission to delete applications via AP CVE-2024-489037.8An improper access control vulnerability in Trend Micro Deep Security Agent 20 could allow a local attacker to escalate privileges on affect CVE-2024-489049.8An command injection vulnerability in Trend Micro Cloud Edge could allow a remote attacker to execute arbitrary code on affected appliances.CVE-2024-489059.1Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.