CVE-2024-7995

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-79982.6In affected versions of Octopus Server OIDC cookies were using the wrong expiration time which could result in them using the maximum lifesp CVE-2024-80005.3On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA s CVE-2024-80014.3A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Hand CVE-2024-80024.3A vulnerability has been found in VIWIS LMS 9.11 and classified as problematic. Affected by this vulnerability is an unknown functionality o CVE-2024-80039.8A vulnerability was found in Go-Tribe gotribe-admin 1.0 and classified as problematic. Affected by this issue is the function InitRoutes of CVE-2024-80045.4A stored Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through CVE-2024-80059.8A vulnerability was found in demozx gf_cms 1.0/1.0.1. It has been classified as critical. This affects the function init of the file interna CVE-2024-80064.4Remote packet capture support is disabled by default in libpcap. When a user builds libpcap with remote packet capture support enabled, one CVE-2024-80078.1A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an CVE-2024-80085.2A reflected cross-site scripting (XSS) vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages CVE-2024-80094.3The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page CVE-2024-80107.5The component accepts XML input through the publisher without disabling external entity resolution. This allows malicious actors to submit a