CVE-2024-51549

CriticalCVSS 9.4/10Last modified Jun 17, 2026

Description

Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.  Affected products:

ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02

Metrics

CVSS 3.1 9.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-36CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Dec 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-51556.1The Inquiry cart WordPress plugin through 3.4.2 does not have CSRF check in some places, and is missing sanitisation as well as escaping, whCVE-2024-515509.8Data Validation / Data Sanitization vulnerabilities in Linux allows unvalidated and unsanitized data to be injected in an Aspect device.  ACVE-2024-5155110.0Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected pCVE-2024-515526.0Weak password storage vulnerabilities exist in ASPECT if administrator credentials become compromisedThis issue affects ASPECT-Enterprise: tCVE-2024-515536.5Predictable filename vulnerabilities in ASPECT may expose sensitive information to a potential attacker if administrator credentials become CVE-2024-515549.8Default Credentail vulnerabilities in ASPECT on Linux allows access to the product using publicly available default credentials.  Affected pCVE-2024-5155510.0Default Credentail vulnerabilities allows access to an Aspect device using publicly available default credentials since the system does not CVE-2024-515566.5This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated reCVE-2024-515576.5This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker CVE-2024-515589.8This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. ACVE-2024-515596.5This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker coCVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and inclu
CVE-2024-51549: Critical severity, CVSS 9.4 | Vulnix