CVE-2024-6785

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

The configuration file stores credentials in cleartext. An attacker with local access rights can read or modify the configuration file, potentially resulting in the service being abused due to sensitive information exposure.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-313CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Sep 21, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-67866.5The vulnerability allows an attacker to craft MQTT messages that include relative path traversal sequences, enabling them to read arbitrary CVE-2024-67875.9This vulnerability occurs when an attacker exploits a race condition between the time a file is checked and the time it is used (TOCTOU). ByCVE-2024-67889.8A remote unauthenticated attacker can use the firmware update feature on the LAN interface of the device to reset the password for the predeCVE-2024-67896.5A path traversal issue in API endpoint in M-Files Server before version 24.8.13981.0 and LTS 24.2.13421.15 SR2 and LTS 23.8.12892.0 SR6 alloCVE-2024-67906.1Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel DriverCVE-2024-67917.8A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. SucceCVE-2024-67923.5The WP ULike WordPress plugin before 4.7.2.1 does not properly sanitize user display names when rendering on a public page.CVE-2024-67939.8A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. SuccCVE-2024-67949.8A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code executionCVE-2024-67959.8In Connex health portal released before8/30/2024, SQL injection vulnerabilities were found that could have allowed an unauthenticated attackCVE-2024-67969.1In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthCVE-2024-67974.8The DL Robots.txt WordPress plugin through 1.2 does not sanitise and escape some of its settings, which could allow high privilege users suc