CVE-2024-7953

HighCVSS 8.7/10Last modified Sep 1, 2026

Description

A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project.

Metrics

CVSS 4.0 8.7/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 1, 2026
Last modified: Sep 1, 2026
NVD status: Awaiting Analysis

Related CVEs from 2024

CVE-2024-79549.8The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A rem CVE-2024-79554.8The Starbox WordPress plugin before 3.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as CVE-2024-79567.6A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability CVE-2024-79579.1An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerabilit CVE-2024-79609.1The Rockwell Automation affected product contains a vulnerability that allows a threat actor to view sensitive information and change settin CVE-2024-79619.8A path traversal vulnerability exists in the Rockwell Automation affected product. If exploited, the threat actor could upload arbitrary fi CVE-2024-79627.5An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading promp CVE-2024-79636.4The CMSMasters Content Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's multiple shortcodes in al CVE-2024-79648.8Use after free in Passwords in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corrupt CVE-2024-79658.8Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption CVE-2024-79668.8Out of bounds memory access in Skia in Google Chrome prior to 128.0.6613.84 allowed a remote attacker who had compromised the renderer proce CVE-2024-79678.8Heap buffer overflow in Fonts in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a