CVE-2024-51556

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in the Wave 2.0 due to insufficient encryption of sensitive data received at the API response. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters through API request URL/payload leading to unauthorized access to sensitive information belonging to other users.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-327

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-515576.5This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker CVE-2024-515589.8This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A CVE-2024-515596.5This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker co CVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and inclu CVE-2024-515604.3This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated re CVE-2024-515617.5This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remo CVE-2024-515626.5The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515636.5The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.CVE-2024-515647.5A guest can trigger an infinite loop in the hda audio driver.CVE-2024-515656.5The hda driver is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515666.5The NVMe driver queue processing is vulernable to guest-induced infinite loops.CVE-2024-515679.8upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and