CVE-2024-34519

Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. If a user can create a dashboard with an auto-login user, data disclosure may occur. Access control can be bypassed when there is a shared dashboard, and its auto-login user has privileges that a dashboard visitor should not have.

• CWE-289

• https://docs.avantra.com/release-notes/24/changes.html
• https://support.avantra.com/support/solutions/articles/44002516766-xan-5367-security-vulnerability-fix-for-dashboards
• https://docs.avantra.com/release-notes/24/changes.html
• https://support.avantra.com/support/solutions/articles/44002516766-xan-5367-security-vulnerability-fix-for-dashboards

Published

May 5, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34508dcmnet in DCMTK before 3.6.9 has a segmentation fault via an…4.3
• CVE-2024-34509dcmdata in DCMTK before 3.6.9 has a segmentation fault via a…5.3
• CVE-2024-34510Gradio before 4.20 allows credential leakage on Windows.7.5
• CVE-2024-34511Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2024-34515image-optimizer before 1.7.3 allows PHAR deserialization, e.…8.8
• CVE-2024-34517The Cypher component in Neo4j 5.0.0 through 5.18 mishandles …6.5
• CVE-2024-34520An authorization bypass vulnerability exists in the Mavenir …8.8
• CVE-2024-34521A directory traversal vulnerability exists in the Mavenir SC…3.5
• CVE-2024-34523AChecker 1.5 allows remote attackers to read the contents of…7.5
• CVE-2024-34524In XLANG OpenAgents through fe73ac4, the allowed_file protec…9.1
• CVE-2024-34525FileCodeBox 2.0 stores a OneDrive password and AWS key in a …5.3
• CVE-2024-34527spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary pri…7.5