CVE-2024-6912

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Use of hard-coded MSSQL credentials in PerkinElmer ProcessPlus on Windows allows an attacker to login remove on all prone installations.This issue affects ProcessPlus: through 1.11.6507.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-798

Affected software

Vendor	Product	Versions
PerkinElmer	ProcessPlus	<= 1.11.6507.0
perkin_elmer	process_plus	<= 1.11.6507.0

References

http://seclists.org/fulldisclosure/2024/Jul/13Exploit, Mailing List, Third Party Advisory
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-perten-processplus/Exploit, Third Party Advisory
http://seclists.org/fulldisclosure/2024/Jul/13Exploit, Mailing List, Third Party Advisory
https://cyberdanube.com/en/en-multiple-vulnerabilities-in-perten-processplus/Exploit, Third Party Advisory

Timeline

Published: Jul 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-69138.8Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue CVE-2024-69149.8An incorrect authorization vulnerability exists in multiple WSO2 products due to a business logic flaw in the account recovery-related SOAP CVE-2024-69159.3JFrog Artifactory versions below 7.90.6, 7.84.20, 7.77.14, 7.71.23, 7.68.22, 7.63.22, 7.59.23, 7.55.18 are vulnerable to Improper Input Vali CVE-2024-69165.5A vulnerability in Zowe CLI allows local, privileged actors to display securely stored properties in cleartext within a terminal using the 'CVE-2024-69179.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Veribilim Software Veribase Orde CVE-2024-69187.5CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the Accutec CVE-2024-69199.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NAC Telecommunication Systems Inc. NAC CVE-2024-69206.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NAC Telecommunication Systems Inc. NAC CVE-2024-69217.5Cleartext Storage of Sensitive Information vulnerability in NAC Telecommunication Systems Inc. NACPremium allows Retrieve Embedded Sensitive CVE-2024-69226.9Automation Anywhere Automation 360 v21-v32 is vulnerable to Server-Side Request Forgery in a web API component. An attacker with unauthentic CVE-2024-69235.5There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serial CVE-2024-69249.8The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJ