CVE-2024-7872

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

Insertion of Sensitive Information Into Sent Data vulnerability in ExtremePACS Extreme XDS allows Retrieve Embedded Sensitive Data.

This issue affects Extreme XDS: before 3933.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-201

Affected software

No affected versions have been published.

Timeline

Published
Mar 6, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-78739.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, CWE - CVE-2024-78745.3Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectiCVE-2024-78755.3Tungsten Automation (Kofax) TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenReCVE-2024-78764.8The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escapeCVE-2024-78774.8The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin before 1.6.7.55 does not sanitise and escapeCVE-2024-78784.8The WP ULike WordPress plugin before 4.7.4 does not sanitise and escape some of its settings, which could allow high privilege users such aCVE-2024-78794.8The WP ULike WordPress plugin before 4.7.5 does not sanitise and escape some of its settings, which could allow high privilege users such aCVE-2024-78815.1An unprivileged context can trigger a data memory-dependent prefetch engine to fetch the contents of a privileged location and consume thoseCVE-2024-78826.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-CoCVE-2024-78833.7When using Arm Cortex-M Security Extensions (CMSE), Secure stack contents can be leaked to Non-secure state via floating-point registers wCVE-2024-78847.5When a canister method is called via ic_cdk::call* , a new Future CallFuture is created and can be awaited by the caller to get the executiCVE-2024-78857.5A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. T
CVE-2024-7872: High severity, CVSS 7.6 | Vulnix