Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-38703 State: PUBLISHED Published: 2023-10-06T13:46:54.238Z Last Updated: 2025-02-13T17:02:32.006Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: pjsip Products: pjproject Problem Types: CWE-416 Description: PJSIP is a free and open source multimedia communication library written in C with high level API in C, C++, Java, C#, and Python languages. SRTP is a higher level media transport which is stacked upon a lower level media transport such as UDP and ICE. Currently a higher level transport is not synchronized with its lower level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capa
wer level transport that may introduce use-after-free issue. This vulnerability affects applications that have SRTP capability (`PJMEDIA_HAS_SRTP` is set) and use underlying media transport other than UDP. This vulnerability’s impact may range from unexpected application termination to control flow hijack/memory corruption. The patch is available as a commit in the master branch. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pjsip/pjproject/security/advisories/GHSA-f76w-fh7c-pc66 - https://github.com/pjsip/pjproject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d - https://lists.debian.org/debian-lts-announce/2023/12/msg00019.htm
ject/commit/6dc9b8c181aff39845f02b4626e0812820d4ef0d - https://lists.debian.org/debian-lts-announce/2023/12/msg00019.html
CVE ID: CVE-2023-38704 State: PUBLISHED Published: 2023-08-07T19:24:33.271Z Last Updated: 2024-10-03T18:05:54.891Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: DataDog Products: import-in-the-middle Problem Types: CWE-20 Description: import-in-the-middle is a module loading interceptor specifically for ESM modules. The import-in-the-middle loader works by generating a wrapper module on the fly. The wrapper uses the module specifier to load the original module and add some wrapping code. Prior to version 1.4.2, it allows for remote code execution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability
cution in cases where an application passes user-supplied input directly to the `import()` function. This vulnerability has been patched in import-in-the-middle version 1.4.2. Some workarounds are available. Do not pass any user-supplied input to `import()`. Instead, verify it against a set of allowed values. If using import-in-the-middle, directly or indirectly, and support for EcmaScript Modules is not needed, ensure that no options are set, either via command-line or the `NODE_OPTIONS` environment variable, that would enable loader hooks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DataDog/import-in-the-middle/security/advis
Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DataDog/import-in-the-middle/security/advisories/GHSA-5r27-rw8r-7967 - https://github.com/DataDog/import-in-the-middle/commit/2531cdd9d1d73f9eaa87c16967f60cb276c1971b
CVE ID: CVE-2023-38706 State: PUBLISHED Published: 2023-09-15T19:22:08.194Z Last Updated: 2024-09-24T18:20:38.265Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open-source discussion platform. Prior to version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches, a malicious user can create an unlimited number of drafts with very long draft keys which may end up exhausting the resources on the server. The issue is patched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There
atched in version 3.1.1 of the `stable` branch and version 3.2.0.beta1 of the `beta` and `tests-passed` branches. There are no known workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-7wpp-4pqg-gvp8
CVE ID: CVE-2023-38707 State: REJECTED Published: N/A Last Updated: 2023-08-04T18:37:42.810Z Description: No description available.
CVE ID: CVE-2023-38708 State: PUBLISHED Published: 2023-08-04T00:12:33.137Z Last Updated: 2024-10-03T18:21:23.455Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: pimcore Products: pimcore Problem Types: CWE-22 Description: Pimcore is an Open Source Data & Experience Management Platform: PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce. A path traversal vulnerability exists in the `AssetController::importServerFilesAction`, which allows an attacker to overwrite or modify sensitive files by manipulating the pimcore_log parameter.This can lead to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or
to potential denial of service---key file overwrite. The impact of this vulnerability allows attackers to: overwrite or modify sensitive files, potentially leading to unauthorized access, privilege escalation, or disclosure of confidential information. This could also cause a denial of service (DoS) if critical system files are overwritten or deleted. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pimcore/pimcore/security/advisories/GHSA-34hj-v8fm-x887 - https://github.com/pimcore/pimcore/commit/58012d0e3b8b926fb54eccbd64ec5c993b30c22c
CVE ID: CVE-2023-38709 State: PUBLISHED Published: 2024-04-04T19:19:35.467Z Last Updated: 2025-11-04T21:08:23.335Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: HTTP response splitting Description: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html - https://security.netapp.com/advisory/ntap-20240415-0013/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedor
ity.netapp.com/advisory/ntap-20240415-0013/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNV4SZAPVS43DZWNFU7XBYYOZEZMI4ZC/ - http://www.openwall.com/lists/oss-security/2024/04/04/3 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I2N2NZEX3MR64IWSGL3QGN7KSRUGAEMF/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LX5U34KYGDYPRH3AJ6MDDCBJDWDPXNVJ/ - https://lists.debian.org/debian-lts-announce/2024/05/msg00013.html - https://support.apple.com/kb/HT214119 - http://seclists.org/fulldisclosure/2024/Jul/18
CVE ID: CVE-2023-38710 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-11-26T21:53:27.752Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protocol ID number of 0 or 1, an error notify INVALID_SPI is sent back. The notify payload's protocol ID is copied from the incoming packet, but the code that verifies outgoing packets fails an assertion that the protocol ID must be ESP (2) or AH(3) and causes the pluto daemon to crash and restart. NOTE: the earliest affected version is 3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
NOTE: the earliest affected version is 3.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libreswan/libreswan/tags - https://libreswan.org/security/CVE-2023-38710/
CVE ID: CVE-2023-38711 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-08-02T17:46:56.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or ID_IPV6_ADDR receives an IDcr payload with ID_FQDN, a NULL pointer dereference causes a crash and restart of the pluto daemon. NOTE: the earliest affected version is 4.6. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/libreswan/libreswan/tags - https://libreswan.org/security/CVE-2023-38711/
CVE ID: CVE-2023-38712 State: PUBLISHED Published: 2023-08-25T00:00:00 Last Updated: 2024-08-02T17:46:56.799Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet contains a Delete/Notify payload followed by further Notifies that act on the ISAKMP SA, such as a duplicated Delete/Notify message, a NULL pointer dereference on the deleted state causes the pluto daemon to crash and restart. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/libreswan/libreswan/tags - https://libreswan.org/security/CVE-2023-38712/
CVE ID: CVE-2023-38713 State: PUBLISHED Published: 2025-01-25T13:56:16.547Z Last Updated: 2025-01-27T14:46:11.289Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-209 Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7159533
CVE ID: CVE-2023-38714 State: PUBLISHED Published: 2025-01-25T13:55:54.926Z Last Updated: 2025-01-27T17:01:26.894Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-209 Description: IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7159533
CVE ID: CVE-2023-38716 State: PUBLISHED Published: 2025-01-25T13:48:45.716Z Last Updated: 2025-01-27T17:04:29.726Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cloud Pak System Problem Types: CWE-209 Description: IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.6 iFix2, 2.3.3.7, 2.3.3.7 iFix1, and 2.3.4.0 could disclose sensitive information about the system that could aid in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7148474
CVE ID: CVE-2023-38718 State: PUBLISHED Published: 2023-09-20T19:12:24.102Z Last Updated: 2024-09-24T15:41:57.484Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Robotic Process Automation, Robotic Process Automation for Cloud Pak Problem Types: CWE-200 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.8 could disclose sensitive information from access to RPA scripts, workflows and related data. IBM X-Force ID: 261606. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7031619 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261606
CVE ID: CVE-2023-38719 State: PUBLISHED Published: 2023-10-16T23:05:41.644Z Last Updated: 2025-02-13T17:02:33.178Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 11.5 could allow a local user with special privileges to cause a denial of service during database deactivation on DPF. IBM X-Force ID: 261607. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7047558 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261607 - https://security.netapp.com/advisory/ntap-20231116-0008/
CVE ID: CVE-2023-38720 State: PUBLISHED Published: 2023-10-16T20:52:54.759Z Last Updated: 2025-06-12T15:13:28.242Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 and 11.5 is vulnerable to denial of service with a specially crafted ALTER TABLE statement. IBM X-Force ID: 261616. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7047489 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261616 - https://security.netapp.com/adviso
rt/pages/node/7047489 - https://exchange.xforce.ibmcloud.com/vulnerabilities/261616 - https://security.netapp.com/advisory/ntap-20231116-0005/
CVE ID: CVE-2023-38721 State: PUBLISHED Published: 2023-08-14T17:25:24.696Z Last Updated: 2024-10-09T16:08:10.575Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: i Problem Types: CWE-269 Description: The IBM i 7.2, 7.3, 7.4, and 7.5 product Facsimile Support for i contains a local privilege escalation vulnerability. A malicious actor could gain access to a command line with elevated privileges allowing root access to the host operating system. IBM X-Force ID: 262173. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7023423 - https://exchange.xforce.ibmcloud.com/vulne
Vulnrichment: References: - https://www.ibm.com/support/pages/node/7023423 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262173
CVE ID: CVE-2023-38722 State: PUBLISHED Published: 2023-10-23T17:40:32.328Z Last Updated: 2024-09-11T14:17:25.153Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling Partner Engagement Manager Problem Types: CWE-79 Description: IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262174. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
sion. IBM X-Force ID: 262174. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7057407 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262174
CVE ID: CVE-2023-38723 State: PUBLISHED Published: 2024-03-13T09:16:40.785Z Last Updated: 2024-08-05T15:26:47.734Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-79 Description: IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 262192. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7139010 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262192
CVE ID: CVE-2023-38724 State: PUBLISHED Published: 2024-05-03T17:36:13.659Z Last Updated: 2024-08-02T17:46:56.692Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Cognos Controller Problem Types: CWE-89 Description: IBM Cognos Controller 10.4.1, 10.4.2, and 11.0.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 262183. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149876 - https://exchange.xforce.ibmcl
t: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149876 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262183
CVE ID: CVE-2023-38727 State: PUBLISHED Published: 2023-12-04T01:08:48.495Z Last Updated: 2025-02-13T17:02:34.374Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted SQL statement. IBM X-Force ID: 262257. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7087143 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262257 - https://security.netapp.com/advisor
t/pages/node/7087143 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262257 - https://security.netapp.com/advisory/ntap-20240119-0001/
CVE ID: CVE-2023-38728 State: PUBLISHED Published: 2023-10-16T21:27:06.469Z Last Updated: 2025-02-13T17:02:35.325Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted XML query statement. IBM X-Force ID: 262258. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7047489 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262258 - https://security.netapp.com/advisory/ntap-20231116-000
9 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262258 - https://security.netapp.com/advisory/ntap-20231116-0006/
CVE ID: CVE-2023-38729 State: PUBLISHED Published: 2024-04-03T12:27:36.197Z Last Updated: 2025-01-09T14:32:36.314Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-200 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to sensitive information disclosure when using ADMIN_CMD with IMPORT or EXPORT. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145721
CVE ID: CVE-2023-38730 State: PUBLISHED Published: 2023-08-27T22:10:11.132Z Last Updated: 2024-09-30T17:49:41.672Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Spectrum Copy Data Management Problem Types: CWE-327 Description: IBM Storage Copy Data Management 2.2.0.0 through 2.2.19.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 262268. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7028841 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262268
CVE ID: CVE-2023-38732 State: PUBLISHED Published: 2023-08-22T13:13:42.214Z Last Updated: 2024-10-01T16:03:30.784Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-532 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7028221 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262289
CVE ID: CVE-2023-38733 State: PUBLISHED Published: 2023-08-22T21:54:14.033Z Last Updated: 2024-10-01T15:53:45.988Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-532 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7028223 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262293
CVE ID: CVE-2023-38734 State: PUBLISHED Published: 2023-08-22T21:18:08.392Z Last Updated: 2024-10-03T13:28:27.675Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Robotic Process Automation Problem Types: 266 Incorrect Privilege Assignment Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7028227 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262481
CVE ID: CVE-2023-38735 State: PUBLISHED Published: 2023-10-22T01:05:02.599Z Last Updated: 2024-09-11T20:08:15.179Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Cognos Dashboards on Cloud Pak for Data Problem Types: CWE-287 Description: IBM Cognos Dashboards on Cloud Pak for Data 4.7.0 could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 262482. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7031207 - https://excha
Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7031207 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262482
CVE ID: CVE-2023-38736 State: PUBLISHED Published: 2023-09-08T18:49:24.176Z Last Updated: 2024-09-26T14:10:11.909Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: QRadar WinCollect Agent Problem Types: 264 Permissions, Privileges, Access Controls Description: IBM QRadar WinCollect Agent 10.0 through 10.1.6, when installed to run as ADMIN or SYSTEM, is vulnerable to a local escalation of privilege attack that a normal user could utilize to gain SYSTEM permissions. IBM X-Force ID: 262542. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7030703 - https://exchange.xforce
ntainer: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7030703 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262542
CVE ID: CVE-2023-38737 State: PUBLISHED Published: 2023-08-16T18:07:30.569Z Last Updated: 2024-10-02T16:02:35.758Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-20 Description: IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7027509 - h
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7027509 - https://exchange.xforce.ibmcloud.com/vulnerabilities/262567