CVE-2024-9498

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK

installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published
Jan 24, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-94998.6DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalCVE-2024-95007.8A maliciously crafted DLL file when placed in temporary files and folders that are leveraged by the Autodesk Installer could lead to escalatCVE-2024-95019.8The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to authentication bypass in all versions up to, and incluCVE-2024-95025.4The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulneraCVE-2024-95034.3The Maintenance & Coming Soon Redirect Animation plugin for WordPress is vulnerable to unauthorized modification of data due to a missing caCVE-2024-95047.2The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in aCVE-2024-95055.4The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Button widgetCVE-2024-95063.7Improper regular expression in Vue's parseHTML function leads to a potential regular expression denial of service vulnerability.CVE-2024-95074.9The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPCVE-2024-95087.8Horner Automation Cscape contains a memory corruption vulnerability, which could allow an attacker to disclose information and execute arbiCVE-2024-95119.8The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerablCVE-2024-95125.9An issue has been discovered in GitLab EE affecting all versions prior to 17.10.8, 17.11 prior to 17.11.4, and 18.0 prior to 18.0.2. It may
CVE-2024-9498: High severity, CVSS 8.6 | Vulnix