CVE-2024-54154

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-23CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Dec 4, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-541555.3In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authenticationCVE-2024-541566.5In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attackCVE-2024-541576.5In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detectorCVE-2024-541585.3In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encodingCVE-2024-541594.1stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.CVE-2024-54165.4The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url CVE-2024-541606.4dashboards-reporting (aka Dashboards Reports) before 2.19.0.0, as shipped in OpenSearch before 2.19, allows XSS because Markdown is not saniCVE-2024-541696.5IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URLCVE-2024-54175.4The Gutentor WordPress plugin before 3.3.6 does not validate and escape some of its block options before outputting them back in a page/posCVE-2024-541705.5IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity thaCVE-2024-541717.1IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exCVE-2024-541724.3IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site re