Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-40657 State: PUBLISHED Published: 2024-09-11T00:09:18.796Z Last Updated: 2024-09-11T14:17:03.812Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In addPreferencesForType of AccountTypePreferenceLoader.java, there is a possible way to disable apps for other users due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603 - https://source.android.com/security
rce.com/platform/packages/apps/Settings/+/8261e0ade3b414fea61d7fe9d8bc6df7a3fc8603 - https://source.android.com/security/bulletin/2024-09-01
CVE ID: CVE-2024-40658 State: PUBLISHED Published: 2024-09-11T00:09:19.108Z Last Updated: 2024-09-11T14:14:33.137Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In getConfig of SoftVideoDecoderOMXComponent.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/av/+/6d23fa05a40e5462d4b9bad28afa932e6e12a4f3 - https://source.android.com/security/bulletin/2024-09-01
CVE ID: CVE-2024-40659 State: PUBLISHED Published: 2024-09-11T00:09:19.421Z Last Updated: 2024-11-04T17:23:40.752Z Vendors: Google Products: Android Problem Types: Denial of service Description: In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/RemoteKe
nalyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/RemoteKeyProvisioning/+/c65dce4c6d8d54e47dce79a56e29e2223a2354e6 - https://source.android.com/security/bulletin/2024-09-01
CVE ID: CVE-2024-40660 State: PUBLISHED Published: 2024-11-13T17:25:12.318Z Last Updated: 2024-11-16T04:55:30.610Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/native/+/064ce6e3235b6318be1e41f1bac9595a98e4aafa - https://android.googlesource.com/platform
ce.com/platform/frameworks/native/+/064ce6e3235b6318be1e41f1bac9595a98e4aafa - https://android.googlesource.com/platform/frameworks/native/+/b6ddf525be3c2abbde59ae1533494b18a7961087 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-40661 State: PUBLISHED Published: 2024-11-13T17:25:12.454Z Last Updated: 2024-12-04T04:55:40.516Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Permission/+/ffd81f212b5594b498f0ba07645c7a181540e494 - https://source.android
ooglesource.com/platform/packages/modules/Permission/+/ffd81f212b5594b498f0ba07645c7a181540e494 - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-40662 State: PUBLISHED Published: 2024-09-11T00:09:19.760Z Last Updated: 2024-09-11T13:54:27.659Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/e7af00cafb52a25933ec4edb80c5111d42af0237 - https://source.android.com/security/bulletin/2024-09-01
CVE ID: CVE-2024-40664 State: PUBLISHED Published: 2025-09-04T19:28:07.752Z Last Updated: 2025-09-05T15:29:36.633Z Vendors: Google Products: Android Problem Types: Denial of service Description: In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/wear/2025-05-01
CVE ID: CVE-2024-40669 State: PUBLISHED Published: 2025-01-28T19:13:40.607Z Last Updated: 2025-01-28T21:05:17.382Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40670 State: PUBLISHED Published: 2025-01-28T19:13:40.727Z Last Updated: 2025-01-28T21:04:16.894Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40671 State: PUBLISHED Published: 2024-11-13T17:25:12.555Z Last Updated: 2024-11-14T15:44:21.478Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://source.android.com/security/bulletin/2024-11-01
CVE ID: CVE-2024-40672 State: PUBLISHED Published: 2025-01-28T19:13:40.821Z Last Updated: 2025-01-28T20:59:08.080Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727 - https://source.android.com/security/bu
form/packages/modules/IntentResolver/+/ccd29124d0d2276a3071c0418c14dec188cd3727 - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40673 State: PUBLISHED Published: 2025-01-28T19:13:40.927Z Last Updated: 2025-02-03T15:12:41.839Z Vendors: Google Products: Android Problem Types: Remote code execution Description: In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9 - https://source.android.com/security/bul
d.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9 - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40674 State: PUBLISHED Published: 2025-01-28T19:13:41.052Z Last Updated: 2025-02-03T15:25:40.280Z Vendors: Google Products: Android Problem Types: Denial of service Description: In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/modules/Wifi/+/debc548ac085ba1ab0582172b97d965e9a1ea43a - https://source.android.com/security/bulletin/2
atform/packages/modules/Wifi/+/debc548ac085ba1ab0582172b97d965e9a1ea43a - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40675 State: PUBLISHED Published: 2025-01-28T19:13:41.191Z Last Updated: 2025-02-06T15:16:25.815Z Vendors: Google Products: Android Problem Types: Denial of service Description: In parseUriInternal of Intent.java, there is a possible infinite loop due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/c6b5490ec659b5854fd429f453f75de5befa6359 - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40676 State: PUBLISHED Published: 2025-01-28T19:13:41.279Z Last Updated: 2025-02-06T15:10:01.515Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In checkKeyIntent of AccountManagerService.java, there is a possible way to bypass intent security check and install an unknown app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/frameworks/base/+/e8a53246607b52b15269f97aef9ba7e928ba2473 - https://source.android.com/s
roid.googlesource.com/platform/frameworks/base/+/e8a53246607b52b15269f97aef9ba7e928ba2473 - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40677 State: PUBLISHED Published: 2025-01-28T19:13:41.402Z Last Updated: 2025-01-28T20:57:11.156Z Vendors: Google Products: Android Problem Types: Elevation of privilege Description: In shouldSkipForInitialSUW of AdvancedPowerUsageDetail.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://android.googlesource.com/platform/packages/apps/Settings/+/db26138f07db830e3fb78283d37de3c0296d93cb - https://source.android.
id.googlesource.com/platform/packages/apps/Settings/+/db26138f07db830e3fb78283d37de3c0296d93cb - https://source.android.com/security/bulletin/2024-10-01
CVE ID: CVE-2024-40679 State: PUBLISHED Published: 2025-01-08T00:44:37.346Z Last Updated: 2025-01-08T17:24:57.144Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Db2 Problem Types: CWE-532 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an information disclosure vulnerability as sensitive information may be included in a log file under specific conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175957
CVE ID: CVE-2024-40680 State: PUBLISHED Published: 2024-09-07T14:02:30.422Z Last Updated: 2024-10-31T16:26:59.453Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-789 Description: IBM MQ 9.3 CD and 9.4 LTS/CD could allow a local user to cause a denial of service due to improper memory allocation causing a segmentation fault. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167732
CVE ID: CVE-2024-40681 State: PUBLISHED Published: 2024-09-07T14:09:19.767Z Last Updated: 2024-10-31T16:31:36.738Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: MQ Problem Types: CWE-266 Description: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD could allow an authenticated user in a specifically defined role, to bypass security restrictions and execute actions against the queue manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167732
CVE ID: CVE-2024-40682 State: PUBLISHED Published: 2025-07-23T11:14:18.732Z Last Updated: 2025-08-18T13:27:52.071Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: SmartCloud Analytics Log Analysis Problem Types: CWE-1287 Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local user to cause a denial of service due to improper validation of specified type of input. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240264
CVE ID: CVE-2024-40686 State: PUBLISHED Published: 2025-07-23T11:12:23.857Z Last Updated: 2025-08-18T01:28:44.168Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: SmartCloud Analytics Log Analysis Problem Types: CWE-644 Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
-site scripting, cache poisoning or session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240270
CVE ID: CVE-2024-40689 State: PUBLISHED Published: 2024-07-26T13:27:26.097Z Last Updated: 2024-08-02T04:33:11.877Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-89 Description: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. IBM X-Force ID: 297719. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160579 - https://exchange.xforce.ibmc
nt: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160579 - https://exchange.xforce.ibmcloud.com/vulnerabilities/297719
CVE ID: CVE-2024-40690 State: PUBLISHED Published: 2024-07-12T17:47:46.998Z Last Updated: 2024-08-02T04:33:11.909Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Server Problem Types: CWE-79 Description: IBM InfoSphere Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 297720. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160103
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160103 - https://exchange.xforce.ibmcloud.com/vulnerabilities/297720
CVE ID: CVE-2024-40691 State: PUBLISHED Published: 2024-12-03T16:41:37.813Z Last Updated: 2024-12-03T19:10:40.681Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cognos Controller Problem Types: CWE-434 Description: IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-40693 State: PUBLISHED Published: 2025-01-24T15:26:27.144Z Last Updated: 2025-02-12T20:01:19.903Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-434 Description: IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168387
CVE ID: CVE-2024-40695 State: PUBLISHED Published: 2024-12-20T13:41:00.327Z Last Updated: 2024-12-20T15:42:12.732Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-434 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/
erforming further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179496
CVE ID: CVE-2024-40696 State: PUBLISHED Published: 2025-01-31T15:24:52.928Z Last Updated: 2025-01-31T15:54:41.669Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/sup
osure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182011
CVE ID: CVE-2024-40697 State: PUBLISHED Published: 2024-08-13T10:59:51.302Z Last Updated: 2024-08-13T13:11:00.325Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Common Licensing Problem Types: CWE-521 Description: IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 297895. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165250 - https://exchange.xforce.ibmcloud.com/vulnerabilities/297895
CVE ID: CVE-2024-40700 State: PUBLISHED Published: 2025-02-04T20:36:10.138Z Last Updated: 2025-02-22T20:57:09.499Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Container Problem Types: CWE-79 Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: Referenc
leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182386
CVE ID: CVE-2024-40702 State: PUBLISHED Published: 2025-01-07T16:02:36.236Z Last Updated: 2025-01-07T16:59:26.656Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: IBM Products: Controller, Cognos Controller Problem Types: CWE-295 Description: IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179163
CVE ID: CVE-2024-40703 State: PUBLISHED Published: 2024-09-22T12:20:28.223Z Last Updated: 2024-09-22T15:27:30.186Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Analytics, Cognos Analytics Reports Problem Types: CWE-522 Description: IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0.7 could allow a local attacker to obtain sensitive information in the form of an API key. An attacker could use this information to launch further attacks against affected applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.co
tacks against affected applications. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7160700 - https://www.ibm.com/support/pages/node/7168038
CVE ID: CVE-2024-40704 State: PUBLISHED Published: 2024-08-15T16:44:10.022Z Last Updated: 2024-08-15T17:35:25.483Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-522 Description: IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. IBM X-Force ID: 298277. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7160853 - https://exchange.xforce.ibmcloud.com/vulnerabilities/298277
CVE ID: CVE-2024-40705 State: PUBLISHED Published: 2024-08-15T16:48:03.025Z Last Updated: 2024-08-19T20:35:38.600Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-405 Description: IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM X-Force ID: 298279. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7160855 - https://exchange.xforce.ibmcloud.com/vulnerabilities/298279