CVE-2024-51559

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

This vulnerability exists in the Wave 2.0 due to improper authorization checks on certain API endpoints. An authenticated remote attacker could exploit this vulnerability by manipulating API input parameters to gain unauthorized access and perform malicious activities on other user accounts.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Nov 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-51566.4The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and inclu CVE-2024-515604.3This vulnerability exists in the Wave 2.0 due to improper exception handling for invalid inputs at certain API endpoint. An authenticated re CVE-2024-515617.5This vulnerability exists in Aero due to improper implementation of OTP validation mechanism in certain API endpoints. An authenticated remo CVE-2024-515626.5The NVMe driver function nvme_opc_get_log_page is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515636.5The virtio_vq_recordon function is subject to a time-of-check to time-of-use (TOCTOU) race condition.CVE-2024-515647.5A guest can trigger an infinite loop in the hda audio driver.CVE-2024-515656.5The hda driver is vulnerable to a buffer over-read from a guest-controlled value.CVE-2024-515666.5The NVMe driver queue processing is vulernable to guest-induced infinite loops.CVE-2024-515679.8upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and CVE-2024-515689.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There CVE-2024-515697.5Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound CVE-2024-51578.8Use after free in Scheduling in Google Chrome prior to 125.0.6422.76 allowed a remote attacker to execute arbitrary code inside a sandbox vi