CVE-2024-27138

** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vulnerability in Apache Archiva. Apache Archiva has a setting to disable user registration, however this restriction can be bypassed. As Apache Archiva has been retired, we do not expect to release a version of Apache Archiva that fixes this issue. You are recommended to look into migrating to a different solution, or isolate your instance from any untrusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

• CWE-863

• http://www.openwall.com/lists/oss-security/2024/03/01/4Mailing List
• https://lists.apache.org/thread/070qcpclcb3sqk1hn8j5lvzohp30k1m2Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/03/01/4Mailing List
• https://lists.apache.org/thread/070qcpclcb3sqk1hn8j5lvzohp30k1m2Mailing List, Vendor Advisory

Published

Mar 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27132Insufficient sanitization in MLflow leads to XSS when runnin…9.6
• CVE-2024-27133Insufficient sanitization in MLflow leads to XSS when runnin…9.6
• CVE-2024-27134Excessive directory permissions in MLflow leads to local pri…7
• CVE-2024-27135Improper input validation in the Pulsar Function Worker allo…9.9
• CVE-2024-27136XSS in Upload page in Apache JSPWiki 2.12.1 and priors allow…6.1
• CVE-2024-27137In Apache Cassandra it is possible for a local attacker with…5.3
• CVE-2024-27139** UNSUPPORTED WHEN ASSIGNED ** Incorrect Authorization vul…7.5
• CVE-2024-2714A vulnerability has been found in Campcodes Complete Online …6.5
• CVE-2024-27140** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of …5.4
• CVE-2024-27141Toshiba printers use XML communication for the API endpoint …5.9
• CVE-2024-27142Toshiba printers use XML communication for the API endpoint …5.9
• CVE-2024-27143Toshiba printers use SNMP for configuration. Using the priva…9.8