CVE-2024-52283

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Missing sanitation of inputs allowed arbitrary users to conduct a stored XSS attack that triggers for users that view a certain project

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
SUSEhackweek< 8d2b6bda67bd0f1914cb0851b8ae71b73e26b156

References

Timeline

Published
Nov 28, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-522847.7Unauthorized disclosure of sensitive data: Any user with `GET` or `LIST` permissions on `BundleDeployment` resources could retrieve Helm valCVE-2024-522855.3A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.8), SiPass integrated ACC-AP (All versions < VCVE-2024-522862.0Stirling-PDF is a locally hosted web application that allows you to perform various operations on PDF files. In affected versions the Merge CVE-2024-522877.2authentik is an open-source identity provider. When using the client_credentials or device_code OAuth grants, it was possible for an attackeCVE-2024-522885.1libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust anCVE-2024-522899.8authentik is an open-source identity provider. Redirect URIs in the OAuth2 provider in authentik are checked by RegEx comparison. When no ReCVE-2024-52296.4The Primary Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pricing Table widget in aCVE-2024-522905.4LF Edge eKuiper is a lightweight internet of things (IoT) data analytics and stream processing engine. Prior to version 2.1.0 user with righCVE-2024-522917.2Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utiliziCVE-2024-522926.5Craft is a content management system (CMS). The dataUrl function can be exploited if an attacker has write permissions on system notificatioCVE-2024-522937.2Craft is a content management system (CMS). Prior to 4.12.2 and 5.4.3, Craft is missing normalizePath in the function FileHelper::absolutePaCVE-2024-522944.3Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference (IDOR) vulnerability in t
CVE-2024-52283: Medium severity, CVSS 5.7 | Vulnix