Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-39704 State: PUBLISHED Published: 2024-06-28T00:00:00.000Z Last Updated: 2025-03-20T21:00:50.416Z Vendors: n/a Products: n/a Problem Types: n/a Description: Soft Circle French-Bread Melty Blood: Actress Again: Current Code through 1.07 Rev. 1.4.0 allows a remote attacker to execute arbitrary code on a client's machine via a crafted packet on TCP port 46318. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/MikeIsAStar/Melty-Blood-Actress-Again-Current-Code-Remote-Code-Execution - https://pastebin.com/agpnQmhu
CVE ID: CVE-2024-39705 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-09-15T19:27:36.034Z Vendors: n/a Products: n/a Problem Types: n/a Description: NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/nltk/nltk/issues/3266 - https://github.com/nltk/nltk/issues/2522 - https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
CVE ID: CVE-2024-39707 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-27T17:11:25.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version 05.46.19; kernel 5.5, version 05.54.19; kernel 5.6, version 05.61.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.insyde.com/security-pledge/SA-2024007
CVE ID: CVE-2024-39708 State: PUBLISHED Published: 2024-06-27T00:00:00 Last Updated: 2024-10-31T13:26:17.983Z Severity: HIGH (CVSS 7 CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:L/S:U/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. Sometimes, a non-administrator user can copy a crafted DLL file to a temporary directory (used by .NET Shadow Copies) such that privilege escalation can occur if the core agent service loads that file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.delinea.com/online-help/
nal Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://docs.delinea.com/online-help/privilege-manager/release-notes/12.0.1-combined.htm - https://www.cyberark.com/resources/threat-research-blog/identity-crisis-the-curious-case-of-a-delinea-local-privilege-escalation-vulnerability
CVE ID: CVE-2024-39709 State: PUBLISHED Published: 2024-11-13T01:54:45.448Z Last Updated: 2024-11-23T21:06:04.916Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a local authenticated attacker to escalate their privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Mu
i.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-39710 State: PUBLISHED Published: 2024-11-13T01:54:45.384Z Last Updated: 2024-12-01T18:25:55.773Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-39711 State: PUBLISHED Published: 2024-11-13T01:54:45.452Z Last Updated: 2024-12-01T18:25:55.769Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-39712 State: PUBLISHED Published: 2024-11-13T01:54:45.518Z Last Updated: 2024-12-01T18:25:55.739Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Ivanti Products: Connect Secure, Policy Secure Description: Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
CVE ID: CVE-2024-39713 State: PUBLISHED Published: 2024-08-05T04:26:06.959Z Last Updated: 2024-09-06T16:32:07.303Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Rocket.Chat Products: Rocket.Chat Description: A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://hackerone.com/reports/1886954
CVE ID: CVE-2024-39714 State: PUBLISHED Published: 2024-09-07T16:11:22.188Z Last Updated: 2024-09-09T16:23:20.600Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Veeam Service Provider Console Description: A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution on VSPC server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-39715 State: PUBLISHED Published: 2024-09-07T16:11:22.204Z Last Updated: 2024-09-09T15:15:08.789Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Veeam Products: Veeam Service Provider Console Description: A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-39717 State: PUBLISHED Published: 2024-08-22T18:47:12.171Z Last Updated: 2025-10-21T22:55:46.628Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Versa Products: Director Description: The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user logged with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin. (Tenant level users do not have this privilege). The “Change Favicon” (Favorite Icon) option can be mis-used to upload a malicious file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Cente
file ending with .png extension to masquerade as image file. This is possible only after a user with Provider-Data-Center-Admin or Provider-Data-Center-System-Admin has successfully authenticated and logged in. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://versa-networks.com/blog/versa-security-bulletin-update-on-cve-2024-39717-versa-director-dangerous-file-type-upload-vulnerability/
CVE ID: CVE-2024-39718 State: PUBLISHED Published: 2024-09-07T16:11:22.180Z Last Updated: 2024-11-01T19:18:00.417Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: Veeam Products: Backup and Recovery Description: An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.veeam.com/kb4649
CVE ID: CVE-2024-39719 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:41:25.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oligo.security/blog/more-models-more-probllms
CVE ID: CVE-2024-39720 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:20:12.939Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF custom magic header. By leveraging a custom Modelfile that includes a FROM statement pointing to the attacker-controlled blob file, the attacker can crash the application through the CreateModel route, leading to a segmentation fault (signal SIGSEGV: segmentation violation). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ollam
SEGV: segmentation violation). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ollama/ollama/compare/v0.1.45...v0.1.46#diff-782c2737eecfa83b7cb46a77c8bdaf40023e7067baccd4f806ac5517b4563131L417 - https://oligo.security/blog/more-models-more-probllms
CVE ID: CVE-2024-39721 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:19:09.068Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is user-controlled and can be set to /dev/random, which is blocking, causing the goroutine to run infinitely (even after the HTTP request is aborted by the client). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ollama/ollama/blob/9164b0161bcb24e543cba835a8863b80af2c0c21/server/routes.go#L557 - https://github.com/ollama/ollama/blob/adeb40eaf2
a/blob/9164b0161bcb24e543cba835a8863b80af2c0c21/server/routes.go#L557 - https://github.com/ollama/ollama/blob/adeb40eaf29039b8964425f69a9315f9f1694ba8/server/routes.go#L536 - https://www.oligo.security/blog/more-models-more-probllms
CVE ID: CVE-2024-39722 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-01T15:11:19.051Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Ollama before 0.1.46. It exposes which files exist on the server on which it is deployed via path traversal in the api/push route. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.oligo.security/blog/more-models-more-probllms
CVE ID: CVE-2024-39723 State: PUBLISHED Published: 2024-07-08T00:38:47.786Z Last Updated: 2024-08-02T04:26:16.072Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Storage Virtualize Problem Types: CWE-1299 Description: IBM FlashSystem 5300 USB ports may be usable even if the port has been disabled by the administrator. A user with physical access to the system could use the USB port to cause loss of access to data. IBM X-Force ID: 295935. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7159333 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295935
CVE ID: CVE-2024-39725 State: PUBLISHED Published: 2024-12-25T13:56:55.358Z Last Updated: 2024-12-26T18:12:05.251Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Engineering Insights Problem Types: CWE-209 Description: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176782
CVE ID: CVE-2024-39726 State: PUBLISHED Published: 2024-11-15T16:13:12.535Z Last Updated: 2024-11-15T17:15:35.473Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Engineering Insights Problem Types: CWE-611 Description: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176208
CVE ID: CVE-2024-39727 State: PUBLISHED Published: 2024-12-25T13:59:06.713Z Last Updated: 2024-12-26T18:11:41.366Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Engineering Insights Problem Types: CWE-1022 Description: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176783
CVE ID: CVE-2024-39728 State: PUBLISHED Published: 2024-07-15T01:34:22.464Z Last Updated: 2024-08-02T04:26:15.986Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-79 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 295967. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/su
295967. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295967
CVE ID: CVE-2024-39729 State: PUBLISHED Published: 2024-07-15T02:07:10.919Z Last Updated: 2024-08-02T04:26:16.023Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-540 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow an authenticated user to obtain sensitive information from source code that could be used in further attacks against the system. IBM X-Force ID: 295968. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295968
CVE ID: CVE-2024-39730 State: PUBLISHED Published: 2025-06-28T00:36:51.884Z Last Updated: 2025-08-24T11:37:28.863Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Datacap Problem Types: CWE-451 Description: IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238443
CVE ID: CVE-2024-39731 State: PUBLISHED Published: 2024-07-15T01:36:11.783Z Last Updated: 2024-08-02T04:26:15.953Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-327 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 295970. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295970
CVE ID: CVE-2024-39732 State: PUBLISHED Published: 2024-07-14T12:39:59.599Z Last Updated: 2024-08-02T04:26:16.026Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-316 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 temporarily stores data from different environments that could be obtained by a malicious user. IBM X-Force ID: 295791. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295791
CVE ID: CVE-2024-39733 State: PUBLISHED Published: 2024-07-14T12:41:47.696Z Last Updated: 2024-09-21T10:00:11.703Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-256 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 295972. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/295972
CVE ID: CVE-2024-39734 State: PUBLISHED Published: 2024-07-14T12:38:03.320Z Last Updated: 2025-03-25T16:39:33.420Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: 614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snoopi
e user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296001
CVE ID: CVE-2024-39735 State: PUBLISHED Published: 2024-07-15T02:05:09.065Z Last Updated: 2024-08-02T04:26:16.020Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-79 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 296002. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.i
orce ID: 296002. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296002
CVE ID: CVE-2024-39736 State: PUBLISHED Published: 2024-07-15T01:28:53.462Z Last Updated: 2024-08-02T04:26:16.013Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-644 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 296003. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http
. IBM X-Force ID: 296003. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296003
CVE ID: CVE-2024-39737 State: PUBLISHED Published: 2024-07-15T01:27:07.662Z Last Updated: 2024-08-02T04:26:15.997Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-209 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 296004. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exch
A ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296004
CVE ID: CVE-2024-39739 State: PUBLISHED Published: 2024-07-15T01:25:48.329Z Last Updated: 2024-08-02T04:26:16.096Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-918 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 296008. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185
st Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296008
CVE ID: CVE-2024-39740 State: PUBLISHED Published: 2024-07-15T02:11:20.973Z Last Updated: 2024-08-02T04:26:15.996Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Datacap Navigator Problem Types: CWE-497 Description: IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 displays version information in HTTP requests that could allow an attacker to gather information for future attacks against the system. IBM X-Force ID: 296009. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160185 - https://exchange.xforce.ibmcloud.com/vulnerabilities/296009