CVE-2024-7404

MEDIUM Year: 2024
CVSS v3 Score
6.5
Medium
Weakness Type
CWE-1021
View all →

Vulnerability Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.

Related Vulnerabilities

CVE-2013-2675

MEDIUM
CVSS:6.5(Medium)

Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.

CWE-10212013

CVE-2017-20041

MEDIUM
CVSS:6.5(Medium)

A vulnerability was found in Ucweb UC Browser 11.2.5.932. It has been classified as critical. Affected is an unknown function of the component HTML Handler. The manipulation of the argument title lead...

CWE-10212017

CVE-2017-5016

MEDIUM
CVSS:6.5(Medium)

Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pages, which allowed a ...

CWE-10212017

CVE-2017-5697

MEDIUM
CVSS:6.5(Medium)

Insufficient clickjacking protection in the Web User Interface of Intel AMT firmware versions before 9.1.40.1000, 9.5.60.1952, 10.0.50.1004, 11.0.0.1205, and 11.6.25.1129 potentially allowing a remote...

CWE-10212017

CVE-2017-7440

MEDIUM
CVSS:6.5(Medium)

Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview is enabled, allows remote attackers to conduct clickjacking...

CWE-10212017

CVE-2018-16172

MEDIUM
CVSS:6.5(Medium)

Improper countermeasure against clickjacking attack in client certificates management screen was discovered in Cybozu Remote Service 3.0.0 to 3.1.8, that allows remote attackers to trick a user to del...

CWE-10212018