CVE-2024-6150

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A non-admin user can cause short-term disruption in Target VM availability in Citrix Provisioning

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
CitrixCitrix Provisioning>= 2402, < 0; >= 22.3 LTSR, < CU5; >= 1912 LTSR, < CU9

References

Timeline

Published
Jul 10, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-61517.8Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges in Virtual Delivery Agent for Windows used by Citrix VirtuCVE-2024-61528.8The Flipbox Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.5 via deserializationCVE-2024-61537.8Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows local attackers to downgrCVE-2024-61546.7Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability. This vulnerability allows local attackers toCVE-2024-61555.4The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Authenticated (Subscriber+) Server-Side Request ForCVE-2024-61563.8Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust storCVE-2024-61575.1An attacker who successfully exploited these vulnerabilities could cause the robot to stop. A vulnerability exists in the PROFINET stack CVE-2024-61584.8The Category Posts Widget WordPress plugin before 4.9.17, term-and-category-based-posts-widget WordPress plugin before 4.9.13 does not validCVE-2024-61599.8The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using iCVE-2024-61609.3SQL Injection vulnerability in MegaBIP software allows attacker to disclose the contents of the database, obtain session cookies or modify tCVE-2024-61618.8The Default Thumbnail Plus plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'get_cachCVE-2024-61627.5A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. Thi
CVE-2024-6150: Medium severity, CVSS 4.3 | Vulnix