An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability.
References
Link | Resource |
---|---|
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993 | Exploit Third Party Advisory |
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 09:01
Type | Values Removed | Values Added |
---|---|---|
References | () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993 - Exploit, Third Party Advisory | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.6 |
11 Sep 2024, 14:53
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
CPE | cpe:2.3:a:ankiweb:anki:24.04:*:*:*:*:*:*:* | |
References | () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1993 - Exploit, Third Party Advisory | |
First Time |
Ankiweb
Ankiweb anki |
24 Jul 2024, 12:55
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
22 Jul 2024, 17:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Jul 2024, 16:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
22 Jul 2024, 15:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-07-22 15:15
Updated : 2024-11-21 09:01
NVD link : CVE-2024-26020
Mitre link : CVE-2024-26020
CVE.ORG link : CVE-2024-26020
JSON object : View
Products Affected
ankiweb
- anki
CWE
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')