Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49315 State: PUBLISHED Published: 2024-10-17T13:29:23.726Z Last Updated: 2024-10-21T15:12:26.138Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: CodeFlock Products: FREE DOWNLOAD MANAGER Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/free-download-manager/wordpress-free-download-manager-plugin-1-0-0-arbitrary-file-deletion-vulnerabil
base/vulnerability/free-download-manager/wordpress-free-download-manager-plugin-1-0-0-arbitrary-file-deletion-vulnerability?_s_id=cve
CVE ID: CVE-2024-49316 State: PUBLISHED Published: 2024-10-17T18:23:40.201Z Last Updated: 2024-10-17T19:21:47.231Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: zodiac Products: Akismet htaccess writer Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer allows Reflected XSS.This issue affects Akismet htaccess writer: from n/a through 1.0.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/akismet-htaccess-writer/wordpress-akismet-htaccess-writer-plugin-1-0-1-cross-site-scripti
ack.com/database/vulnerability/akismet-htaccess-writer/wordpress-akismet-htaccess-writer-plugin-1-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49317 State: PUBLISHED Published: 2024-10-17T17:13:36.380Z Last Updated: 2024-10-17T20:17:49.231Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ZIPANG Products: Point Maker Problem Types: CWE-98 Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through 0.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/point-maker/wordpress-point-maker-plugin-0-1-4-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-49318 State: PUBLISHED Published: 2024-10-17T17:11:45.801Z Last Updated: 2024-10-17T20:23:59.194Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Scott Olson Products: My Reading Library Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Scott Olson My Reading Library allows Object Injection.This issue affects My Reading Library: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/my-reading-library/wordpress-my-reading-library-plugin-1-0-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49319 State: PUBLISHED Published: 2024-10-17T18:21:10.315Z Last Updated: 2024-10-17T18:34:13.424Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: B.M. Rafiul Alam Products: Awesome Contact Form7 for Elementor Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor allows Stored XSS.This issue affects Awesome Contact Form7 for Elementor: from n/a through 3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/awesome-contact-form7-for-elementor/
CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/awesome-contact-form7-for-elementor/wordpress-awesome-contact-form7-for-elementor-plugin-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49320 State: PUBLISHED Published: 2024-10-17T11:48:41.626Z Last Updated: 2024-10-17T13:08:56.023Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dennis Hoppe Products: Encyclopedia / Glossary / Wiki Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dennis Hoppe Encyclopedia / Glossary / Wiki allows Reflected XSS.This issue affects Encyclopedia / Glossary / Wiki: from n/a through 1.7.60. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/encyclopedia-lexicon-glossary-wiki-dictionary/wordpress
ent: References: - https://patchstack.com/database/vulnerability/encyclopedia-lexicon-glossary-wiki-dictionary/wordpress-encyclopedia-glossary-wiki-plugin-1-7-60-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49321 State: PUBLISHED Published: 2024-10-21T11:11:02.034Z Last Updated: 2024-10-21T18:54:28.339Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Colorlib Products: Simple Custom Post Order Problem Types: CWE-862 Description: Missing Authorization vulnerability in Colorlib Simple Custom Post Order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through 2.5.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-custom-post-order/wordpress-simple-custom-post-order-plugin-2-5-7-broken-access-control-vul
atabase/vulnerability/simple-custom-post-order/wordpress-simple-custom-post-order-plugin-2-5-7-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-49322 State: PUBLISHED Published: 2024-10-17T17:38:30.263Z Last Updated: 2024-10-17T18:31:11.826Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: CodePassenger Products: Job Board Manager for WordPress Problem Types: CWE-266 Description: Incorrect Privilege Assignment vulnerability in CodePassenger Job Board Manager for WordPress allows Privilege Escalation.This issue affects Job Board Manager for WordPress: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jemployee/wordpress-job-board-manager-for-wordpress-plugin-1-0-privilege-escalation-vulnerability?_s_i
ase/vulnerability/jemployee/wordpress-job-board-manager-for-wordpress-plugin-1-0-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-49323 State: PUBLISHED Published: 2024-10-20T07:53:28.670Z Last Updated: 2024-10-20T13:34:20.022Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Sourav Products: All in One Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sourav All in One Slider allows Reflected XSS.This issue affects All in One Slider: from n/a through 1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/all-in-one-slider/wordpress-all-in-one-slider-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_
nerability/all-in-one-slider/wordpress-all-in-one-slider-plugin-1-1-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49324 State: PUBLISHED Published: 2024-10-20T08:51:59.297Z Last Updated: 2024-10-21T19:02:10.553Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Sovratec Products: Sovratec Case Management Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Sovratec Sovratec Case Management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sovratec-case-management/wordpress-sovratec-case-management-plugin-1-0-0-arbitrary-file-upload-vulner
base/vulnerability/sovratec-case-management/wordpress-sovratec-case-management-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49325 State: PUBLISHED Published: 2024-10-20T10:40:35.656Z Last Updated: 2024-10-21T19:08:00.730Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wpdiscover Products: Photo Gallery Builder Problem Types: CWE-862 Description: Subscriber Broken Access Control in Photo Gallery Builder <= 3.0 versions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/photo-gallery-builder/wordpress-photo-gallery-builder-plugin-3-0-broken-access-control-to-notice-dismissal-vulnerability?_s_id=cve
CVE ID: CVE-2024-49326 State: PUBLISHED Published: 2024-10-20T08:50:41.961Z Last Updated: 2024-10-21T18:35:07.681Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Vasilis Kerasiotis Products: Affiliator Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Vasilis Kerasiotis Affiliator allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through 2.1.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliator-lite/wordpress-affiliator-plugin-2-1-3-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49327 State: PUBLISHED Published: 2024-10-20T08:48:17.412Z Last Updated: 2024-10-21T18:10:41.282Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Asep Bagja Priandana Products: Woostagram Connect Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Asep Bagja Priandana Woostagram Connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through 1.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woostagram-connect/wordpress-woostagram-connect-plugin-1-0-2-arbitrary-file-upload-vulnerabilit
m/database/vulnerability/woostagram-connect/wordpress-woostagram-connect-plugin-1-0-2-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49328 State: PUBLISHED Published: 2024-10-20T07:58:15.308Z Last Updated: 2024-10-21T16:10:18.608Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Vivek Tamrakar Products: WP REST API FNS Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Vivek Tamrakar WP REST API FNS allows Authentication Bypass.This issue affects WP REST API FNS: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rest-api-fns/wordpress-wp-rest-api-fns-plugin-plugin-1-0-0-account-takeover-vulnerability?_s_id=cve
CVE ID: CVE-2024-49329 State: PUBLISHED Published: 2024-10-20T08:47:04.502Z Last Updated: 2024-10-21T16:01:12.274Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Vivek Tamrakar Products: WP REST API FNS Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Vivek Tamrakar WP REST API FNS allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through 1.0.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rest-api-fns/wordpress-wp-rest-api-fns-plugin-1-0-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49330 State: PUBLISHED Published: 2024-10-20T08:45:46.793Z Last Updated: 2024-10-21T16:02:36.485Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: brx8r Products: Nice Backgrounds Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nicebackgrounds/wordpress-nice-backgrounds-plugin-1-0-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49331 State: PUBLISHED Published: 2024-10-20T08:43:43.436Z Last Updated: 2024-10-21T16:09:20.802Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Myriad Solutionz Products: Property Lot Management System Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through 4.2.38. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/plms/wordpress-property-lot-management-system-plugin-4-2-38-arbit
ences: - https://patchstack.com/database/vulnerability/plms/wordpress-property-lot-management-system-plugin-4-2-38-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-49332 State: PUBLISHED Published: 2024-10-20T08:10:50.268Z Last Updated: 2024-10-21T19:30:40.384Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Giveaway Boost Products: Giveaway Boost Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/giveaway-boost/wordpress-giveaway-boost-plugin-2-1-4-php-object-injection-vulnerability?_s_id=cve
CVE ID: CVE-2024-49333 State: PUBLISHED Published: 2025-01-21T13:40:32.700Z Last Updated: 2025-01-21T14:40:35.634Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L) Vendors: NotFound Products: Hero Mega Menu - Responsive WordPress Menu Plugin Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NotFound Hero Mega Menu - Responsive WordPress Menu Plugin allows SQL Injection. This issue affects Hero Mega Menu - Responsive WordPress Menu Plugin: from n/a through 1.16.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hmenu/vul
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/hmenu/vulnerability/wordpress-hero-menu-plugin-1-16-5-sql-injection-vulnerability-2?_s_id=cve
CVE ID: CVE-2024-49334 State: PUBLISHED Published: 2024-10-20T07:52:28.742Z Last Updated: 2024-10-20T13:34:40.064Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Unizoe Web Solutions Products: jLayer Parallax Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Unizoe Web Solutions jLayer Parallax Slider allows Reflected XSS.This issue affects jLayer Parallax Slider: from n/a through 1.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/jlayer-parallax-slider-wp/wordpress-jlayer-parallax-slider-plugin-
nces: - https://patchstack.com/database/vulnerability/jlayer-parallax-slider-wp/wordpress-jlayer-parallax-slider-plugin-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49335 State: PUBLISHED Published: 2024-10-20T10:08:20.369Z Last Updated: 2024-10-20T13:50:29.213Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Edush Maxim Products: GoogleDrive folder list Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/googledrive-folder-list/wordpress-googledrive-folder-list-plugin-2-2-2-csrf-to-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-49336 State: PUBLISHED Published: 2024-12-19T17:21:22.636Z Last Updated: 2025-02-26T18:03:29.987Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security Guardium Problem Types: CWE-918 Description: IBM Security Guardium 11.5 and 12.0 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179369
CVE ID: CVE-2024-49337 State: PUBLISHED Published: 2025-02-20T12:09:55.675Z Last Updated: 2025-08-15T14:43:41.449Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-80 Description: IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field of an object to inject malicious script into an email which would be executed in a victim's mail client within the security context of
o inject malicious script into an email which would be executed in a victim's mail client within the security context of the OpenPages mail message. An attacker could use this for phishing or identity theft attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49338 State: PUBLISHED Published: 2025-01-18T15:00:16.148Z Last Updated: 2025-01-21T20:59:39.138Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: App Connect Enterprise Problem Types: CWE-1323 Description: IBM App Connect Enterprise 12.0.1.0 through 12.0.7.0and 13.0.1.0 under certain configurations could allow a privileged user to obtain JMS credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175396
CVE ID: CVE-2024-49339 State: PUBLISHED Published: 2025-01-31T16:13:39.941Z Last Updated: 2025-01-31T16:48:05.270Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Financial Transaction Manager for SWIFT Services for Multiplatforms Problem Types: CWE-79 Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP
nctionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182201
CVE ID: CVE-2024-49340 State: PUBLISHED Published: 2024-10-15T23:57:15.859Z Last Updated: 2024-10-16T14:11:54.598Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: Watson Studio Local Problem Types: CWE-352 Description: IBM Watson Studio Local 1.2.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/1144438
CVE ID: CVE-2024-49342 State: PUBLISHED Published: 2025-07-28T15:26:35.209Z Last Updated: 2025-07-28T17:19:52.455Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Informix Dynamic Server Problem Types: CWE-307 Description: IBM Informix Dynamic Server 12.10 and 14.10 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240777
CVE ID: CVE-2024-49343 State: PUBLISHED Published: 2025-07-28T15:27:37.588Z Last Updated: 2025-07-28T17:20:17.395Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Informix Dynamic Server Problem Types: CWE-80 Description: IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240777
CVE ID: CVE-2024-49344 State: PUBLISHED Published: 2025-02-20T12:08:23.999Z Last Updated: 2025-08-15T14:46:14.557Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-384 Description: IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages with Watson Assistant chat feature enabled the application establishes a session when a user logs in and uses chat, but the chat session is still left active after logout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49348 State: PUBLISHED Published: 2025-02-05T11:30:05.572Z Last Updated: 2025-02-22T21:00:11.012Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-266 Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 allows restricting access to organizational data to valid contexts. The fact that tasks of type comment can be reassigned via API implicitly grants access to user queries in an unexpected context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
s access to user queries in an unexpected context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182403
CVE ID: CVE-2024-49349 State: PUBLISHED Published: 2025-01-31T16:14:22.830Z Last Updated: 2025-01-31T16:47:30.164Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Financial Transaction Manager for SWIFT Services for Multiplatforms Problem Types: CWE-79 Description: IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP
nctionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182203
CVE ID: CVE-2024-49350 State: PUBLISHED Published: 2025-05-29T19:18:06.431Z Last Updated: 2025-08-26T14:55:29.346Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-121 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7235069