CVE-2024-51557

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in the Wave 2.0 due to missing rate limiting on OTP requests in an API endpoint. An authenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoint which could lead to the OTP bombing/flooding on the targeted system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-799 CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-515589.8This vulnerability exists in the Wave 2.0 due to missing restrictions for excessive failed authentication attempts on its API based login. A CVE-2024-515596.5This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker co CVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and inclu CVE-2024-515604.3This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated re CVE-2024-515617.5This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remo CVE-2024-515626.5The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515636.5The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.CVE-2024-515647.5A guest can trigger an infinite loop in the hda audio driver.CVE-2024-515656.5The hda driver is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515666.5The NVMe driver queue processing is vulernable to guest-induced infinite loops.CVE-2024-515679.8upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and CVE-2024-515689.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There