Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-51423 State: PUBLISHED Published: 2025-09-02T00:00:00.000Z Last Updated: 2025-09-02T19:41:36.957Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://docs.offsecguy.com/cve/infor/vulnerability/reflected-xss
CVE ID: CVE-2024-51424 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-11-04T05:56:20.124579 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Wzy-source/Gala/blob/main/CVEs/AURA_0x967d176328948e4db4446b8caf623ff9b47221fb.md
CVE ID: CVE-2024-51425 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-11-04T05:58:09.205114 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Wzy-source/Gala/blob/main/CVEs/WaterToken_0x8890963266f895aca11fbe4679a1f9cc472f6531.md
CVE ID: CVE-2024-51426 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-11-04T06:02:16.116534 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Wzy-source/Gala/blob/main/CVEs/EOTT_0x5fe0971167215aade651f76492f8489e43ceb48a.md
CVE ID: CVE-2024-51427 State: PUBLISHED Published: 2024-10-30T00:00:00 Last Updated: 2024-11-04T05:53:54.318347 Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Wzy-source/Gala/blob/main/CVEs/PepeGxng_0x5d8d1f28cad84fad8d2fea9fdd4ab5022d23b0fe.md
CVE ID: CVE-2024-51428 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T16:57:54.323Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espressif/esp-idf - https://gitee.com/guozhi123456/vulnerability-Report/blob/master/Esp/Accept_Invaild_Address.md
CVE ID: CVE-2024-51430 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-10-31T17:00:36.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.sourcecodester.com - https://github.com/BLACK-SCORP10/CVE-2024-51430
CVE ID: CVE-2024-51431 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-05T21:02:35.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.lb-link.com/ - https://github.com/MatJosephs/CVEs/tree/main/CVE-2024-51431
CVE ID: CVE-2024-51432 State: PUBLISHED Published: 2024-11-01T00:00:00 Last Updated: 2024-11-04T21:45:14.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not being sanitized Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.fiberhome.com/ - https://github.com/MatJosephs/CVEs/tree/main/CVE-2024-51432
CVE ID: CVE-2024-51434 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T16:32:11.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://georgyg.com/home/froala-wysiwyg-editor---xss-cve-2024-51434/
CVE ID: CVE-2024-51440 State: PUBLISHED Published: 2025-02-12T00:00:00.000Z Last Updated: 2025-03-22T14:05:04.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sharedobject.blog/posts/nothing-bpf/
CVE ID: CVE-2024-51442 State: PUBLISHED Published: 2025-01-08T00:00:00 Last Updated: 2025-01-08T19:46:55.729Z Vendors: n/a Products: n/a Problem Types: n/a Description: Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sourceforge.net/projects/minidlna/ - https://sourceforge.net/p/minidlna/git/ci/master/tree/minidlna.c - https://sourceforge.net/p/minidlna/bugs/364/ - https://github.com/mselbrede/CVE-2024-51442
CVE ID: CVE-2024-51444 State: PUBLISHED Published: 2025-05-13T09:38:21.392Z Last Updated: 2025-05-13T19:03:52.314Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Polarion V2310, Polarion V2404 Problem Types: CWE-89 Description: A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database. Additional Analyst Notes: - CISA ADP Vulnr
ion controls and allows to download any data from the application's database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-162255.html
CVE ID: CVE-2024-51445 State: PUBLISHED Published: 2025-05-13T09:38:22.679Z Last Updated: 2025-05-13T19:02:54.611Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Siemens Products: Polarion V2310, Polarion V2404 Problem Types: CWE-611 Description: A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemen
from the application server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-162255.html
CVE ID: CVE-2024-51446 State: PUBLISHED Published: 2025-05-13T09:38:24.164Z Last Updated: 2025-05-13T16:11:11.445Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Siemens Products: Polarion V2310, Polarion V2404 Problem Types: CWE-79 Description: A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application. Additional An
oading specially crafted xml files that are later downloaded and viewed by other users of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-162255.html
CVE ID: CVE-2024-51447 State: PUBLISHED Published: 2025-05-13T09:38:25.452Z Last Updated: 2025-05-13T15:57:37.712Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Siemens Products: Polarion V2310, Polarion V2404 Problem Types: CWE-204 Description: A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: -
er to distinguish between valid and invalid usernames. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-162255.html
CVE ID: CVE-2024-51448 State: PUBLISHED Published: 2025-01-18T15:08:42.484Z Last Updated: 2025-01-21T20:58:29.659Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-277 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service. A subsequent service or server restart will then run that binary with administrator privilege. Additional Analyst Note
. A subsequent service or server restart will then run that binary with administrator privilege. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177586
CVE ID: CVE-2024-51450 State: PUBLISHED Published: 2025-02-06T00:15:03.488Z Last Updated: 2025-02-22T22:08:47.527Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Directory Problem Types: CWE-78 Description: IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182558
CVE ID: CVE-2024-51453 State: PUBLISHED Published: 2025-05-28T15:22:39.745Z Last Updated: 2025-08-15T14:35:08.705Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling Secure Proxy Problem Types: CWE-22 Description: IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234887
CVE ID: CVE-2024-51456 State: PUBLISHED Published: 2025-01-12T13:26:34.770Z Last Updated: 2025-01-13T15:15:57.927Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Robotic Process Automation Problem Types: CWE-780 Description: IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180685
CVE ID: CVE-2024-51457 State: PUBLISHED Published: 2025-01-22T16:36:54.641Z Last Updated: 2025-02-18T19:38:42.714Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Robotic Process Automation for Cloud Pak Problem Types: CWE-79 Description: IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7181230
CVE ID: CVE-2024-51459 State: PUBLISHED Published: 2025-03-19T18:08:06.215Z Last Updated: 2025-09-01T01:03:21.027Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-280 Description: IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185056
CVE ID: CVE-2024-51460 State: PUBLISHED Published: 2024-12-11T12:15:49.427Z Last Updated: 2024-12-11T14:40:49.204Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-209 Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177698
CVE ID: CVE-2024-51461 State: PUBLISHED Published: 2025-04-11T01:13:57.207Z Last Updated: 2025-09-01T00:54:56.805Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: IBM Products: QRadar WinCollect Agent Problem Types: CWE-770 Description: IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7230614
CVE ID: CVE-2024-51462 State: PUBLISHED Published: 2025-01-17T02:16:00.767Z Last Updated: 2025-02-12T20:31:24.004Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: QRadar WinCollect Agent Problem Types: CWE-471 Description: IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176043
CVE ID: CVE-2024-51463 State: PUBLISHED Published: 2024-12-21T13:46:01.436Z Last Updated: 2025-11-03T22:28:32.889Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: i Problem Types: CWE-918 Description: IBM i 7.3, 7.4, and 7.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7179509
CVE ID: CVE-2024-51464 State: PUBLISHED Published: 2024-12-21T13:44:59.157Z Last Updated: 2025-11-03T22:28:34.370Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: i Problem Types: CWE-288 Description: IBM i 7.3, 7.4, and 7.5 is vulnerable to bypassing Navigator for i interface restrictions. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to remotely perform operations that the user is not allowed to perform when using Navigator for i. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7179509
CVE ID: CVE-2024-51465 State: PUBLISHED Published: 2024-12-04T14:08:58.092Z Last Updated: 2024-12-04T14:29:54.978Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: App Connect Enterprise Certified Container Problem Types: CWE-78 Description: IBM App Connect Enterprise Certified Container 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, and 12.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177814
CVE ID: CVE-2024-51466 State: PUBLISHED Published: 2024-12-20T13:38:55.895Z Last Updated: 2024-12-20T15:43:29.891Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-917 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 is vulnerable to an Expression Language (EL) Injection vulnerability. A remote attacker could exploit this vulnerability to expose sensitive information, consume memory resources, and/or cause the server to crash when using a specially crafted EL statement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7
EL statement. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179496
CVE ID: CVE-2024-51470 State: PUBLISHED Published: 2024-12-18T19:56:10.377Z Last Updated: 2024-12-18T20:24:38.409Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ, MQ Appliance, MQ for HPE NonStop Problem Types: CWE-754 Description: IBM MQ 9.1 LTS, 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, 9.4 CD, IBM MQ Appliance 9.3 LTS, 9.3 CD, 9.4 LTS, and IBM MQ for HPE NonStop 8.1.0 through 8.1.0.25 could allow an authenticated user to cause a denial-of-service due to messages with improperly set values. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179137 - https://www.ibm.com/support/pages/node/7178
Vulnrichment: References: - https://www.ibm.com/support/pages/node/7179137 - https://www.ibm.com/support/pages/node/7178085 - https://www.ibm.com/support/pages/node/7177593
CVE ID: CVE-2024-51471 State: PUBLISHED Published: 2024-12-19T17:11:02.223Z Last Updated: 2024-12-20T17:55:19.110Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Appliance Problem Types: CWE-125 Description: IBM MQ Appliance 9.3 LTS, 9.3 CD, and 9.4 LTS web console could allow an authenticated user to cause a denial-of-service when trace is enabled due to information being written into memory outside of the intended buffer size. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7178243
CVE ID: CVE-2024-51472 State: PUBLISHED Published: 2025-01-06T16:38:11.973Z Last Updated: 2025-08-27T21:33:04.984Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: DevOps Deploy, UrbanCode Deploy Problem Types: CWE-80 Description: IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177856
CVE ID: CVE-2024-51473 State: PUBLISHED Published: 2025-07-29T19:02:40.346Z Last Updated: 2025-08-17T01:21:55.841Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 Problem Types: CWE-121 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240944
CVE ID: CVE-2024-51475 State: PUBLISHED Published: 2025-05-16T00:44:43.744Z Last Updated: 2025-08-26T15:06:40.342Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Content Navigator Problem Types: CWE-80 Description: IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7233695
CVE ID: CVE-2024-51476 State: PUBLISHED Published: 2025-03-06T16:28:03.671Z Last Updated: 2025-09-01T01:08:47.637Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-307 Description: IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184961
CVE ID: CVE-2024-51477 State: PUBLISHED Published: 2025-03-28T23:51:32.765Z Last Updated: 2025-09-01T01:00:10.237Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-203 Description: IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable response discrepancy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185058
CVE ID: CVE-2024-51478 State: PUBLISHED Published: 2024-10-31T16:15:46.811Z Last Updated: 2024-10-31T16:51:13.578Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L) Vendors: YesWiki Products: yeswiki Problem Types: CWE-327 Description: YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the password reset key allows it to be recovered and used to reset the password of any account. This issue is fixed in 4.4.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3 - https://github.com/YesWiki/yeswiki/commit/
https://github.com/YesWiki/yeswiki/security/advisories/GHSA-4fvx-h823-38v3 - https://github.com/YesWiki/yeswiki/commit/b5a8f93b87720d5d5f033a4b3a131ce0fb621dbc - https://github.com/YesWiki/yeswiki/commit/e1285709f6f6a2277bd0075acf369f33cefd78f7