CVE-2024-8058

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

An improper parsing vulnerability was reported in the FileZ client that could allow a crafted file in the FileZ directory to read arbitrary files on the device due to URL preloading.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-1287

Affected software

Vendor	Product	Versions
Lenovo	FileZ Client	< 9.8.6.0

References

https://www.filez.com/securityPolicy/1.html?1733849740

Timeline

Published: Dec 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-80594.3IPMI credentials may be captured in XCC audit log entries when the account username length is 16 characters.CVE-2024-80617.5In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the server to w CVE-2024-80627.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque CVE-2024-80637.5A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted ty CVE-2024-80658.1A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions i CVE-2024-80668.8The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' CVE-2024-80675.8In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-80688.0Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Wind CVE-2024-80698.0Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authentica CVE-2024-80708.5CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary CVE-2024-80717.2Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as s CVE-2024-80725.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users