CVE-2024-8891

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-359

Affected software

No affected versions have been published.

Timeline

Published: Sep 18, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-88929.1Vulnerability in CIRCUTOR TCP2RS+ firmware version 1.3b, which could allow an attacker to modify any configuration value, even if the device CVE-2024-88937.3Use of Hard-coded Credentials vulnerability in GoodWe Technologies Co., Ltd. GW1500‑XS allows anyone in physical proximity to the device to CVE-2024-88948.1Out-of-bounds Write vulnerability was discovered in Open Design Alliance Drawings SDK before 2025.10. Reading crafted DWF file and missing p CVE-2024-88967.8A maliciously crafted DXF file when parsed in acdb25.dll through Autodesk AutoCAD can force to access a variable prior to initialization. A CVE-2024-88976.1Under certain conditions, an attacker with the ability to redirect users to a malicious site via an open redirect on a trusted site, may be CVE-2024-88989.8A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry). This CVE-2024-88994.3The Jeg Elementor Kit plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.9 via t CVE-2024-89007.5An attacker could write data to the user's clipboard, bypassing the user prompt, during a certain sequence of navigational events. This vuln CVE-2024-89017.5The AWS ALB Route Directive Adapter For Istio repo https://github.com/awslabs/aws-alb-route-directive-adapter-for-istio/tree/master provid CVE-2024-89024.3The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13 CVE-2024-89034.7Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis CVE-2024-89048.8Type Confusion in V8 in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to potentially exploit heap corruption via a crafted