CVE-2024-52944

An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.

• CWE-79

• https://www.veritas.com/support/en_US/security/VTS24-013Vendor Advisory

Published

Nov 18, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-52939Kernel software installed and running inside a Guest VM may …7.8
• CVE-2024-5294D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Den…6.5
• CVE-2024-52940AnyDesk through 8.1.0 on Windows, when Allow Direct Connecti…7.5
• CVE-2024-52941An issue was discovered in Veritas Enterprise Vault before 1…5.4
• CVE-2024-52942An issue was discovered in Veritas Enterprise Vault before 1…5.4
• CVE-2024-52943An issue was discovered in Veritas Enterprise Vault before 1…5.4
• CVE-2024-52945An issue was discovered in Veritas NetBackup before 10.5. Th…7.8
• CVE-2024-52946An issue was discovered in LemonLDAP::NG before 2.20.1. An I…8.8
• CVE-2024-52947A cross-site scripting (XSS) vulnerability in LemonLDAP::NG …5.4
• CVE-2024-52949iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/if…7.5
• CVE-2024-5295D-Link G416 flupl self Command Injection Remote Code Executi…8.8
• CVE-2024-52951Stored Cross-Site Scripting in the Access Request History in…8