CVE-2024-56477

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Feb 14, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-56485.4The LearnDash LMS – Reports plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on sev CVE-2024-56498.8The Universal Slider plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.6.5 via deserializat CVE-2024-564933.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564943.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564953.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564963.3IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This informa CVE-2024-564976.7An improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiMail versions 7.2.0 through 7 CVE-2024-56508.5DLL Hijacking vulnerability has been found in CENTUM CAMS Log server provided by Yokogawa Electric Corporation. If an attacker is somehow ab CVE-2024-565075.4LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a reflected cross-site scripting (XSS) vulnera CVE-2024-565087.6LinkAce is a self-hosted archive to collect links of your favorite websites. Prior to 1.15.6, a file upload vulnerability exists in the Link CVE-2024-565098.6changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper inpu CVE-2024-56518.8A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying