Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-43153 State: PUBLISHED Published: 2024-08-13T11:39:32.039Z Last Updated: 2024-08-13T14:23:25.027Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WofficeIO Products: Woffice Problem Types: CWE-269 Description: Improper Privilege Management vulnerability in WofficeIO Woffice allows Privilege Escalation.This issue affects Woffice: from n/a through 5.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woffice/wordpress-woffice-theme-5-4-10-unauthenticated-privilege-escalation-vulnerability?_s_id=cve
CVE ID: CVE-2024-43154 State: PUBLISHED Published: 2024-11-01T14:17:44.758Z Last Updated: 2024-11-04T16:27:37.024Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: BracketSpace Products: Advanced Cron Manager – debug & control Problem Types: CWE-862 Description: Missing Authorization vulnerability in BracketSpace Advanced Cron Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Cron Manager – debug & control: from n/a through 2.5.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-cron-manager/wordpress-advanced-cron-manager-debug-con
erences: - https://patchstack.com/database/vulnerability/advanced-cron-manager/wordpress-advanced-cron-manager-debug-control-plugin-2-5-9-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43155 State: PUBLISHED Published: 2024-08-12T22:06:59.155Z Last Updated: 2024-08-14T14:14:18.172Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: PickPlugins Products: ComboBlocks Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins ComboBlocks allows Stored XSS.This issue affects ComboBlocks: from n/a through 2.2.86. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/post-grid/wordpress-comboblocks-plugin-2-2-86-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43156 State: PUBLISHED Published: 2024-08-12T22:03:12.013Z Last Updated: 2024-08-13T17:00:44.747Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: AddonMaster Products: Post Grid Master Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Reflected XSS.This issue affects Post Grid Master: from n/a through 3.4.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-10-reflected-cross-site-scripting-xss-vulne
tabase/vulnerability/ajax-filter-posts/wordpress-post-grid-master-plugin-3-4-10-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43157 State: PUBLISHED Published: 2024-11-01T14:17:44.128Z Last Updated: 2024-11-01T19:27:53.297Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: nCrafts Products: FormCraft Problem Types: CWE-862 Description: Missing Authorization vulnerability in nCrafts FormCraft allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FormCraft: from n/a through 1.2.10. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/formcraft-form-builder/wordpress-formcraft-plugin-1-2-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43158 State: PUBLISHED Published: 2024-11-01T14:17:43.515Z Last Updated: 2024-11-05T21:15:34.981Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Masteriyo Products: Masteriyo - LMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Masteriyo Masteriyo - LMS allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masteriyo - LMS: from n/a through 1.11.4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/learning-management-system/wordpress-masteriyo-lms-plugin-1-11-4-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43159 State: PUBLISHED Published: 2024-11-01T14:17:42.918Z Last Updated: 2024-11-05T21:20:29.632Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Masteriyo Products: Masteriyo - LMS Problem Types: CWE-862 Description: Missing Authorization vulnerability in Masteriyo Masteriyo - LMS allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Masteriyo - LMS: from n/a through 1.11.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/learning-management-system/wordpress-masteriyo-lms-plugin-1-11-6-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43160 State: PUBLISHED Published: 2024-08-13T11:41:11.997Z Last Updated: 2024-08-13T13:13:56.596Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: BerqWP Products: BerqWP Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/searchpro/wordpress-berqwp-plugin-1-7-6-unauthenticated-arbitrary-file-upload-vulnerability?_s_id=cve
CVE ID: CVE-2024-43161 State: PUBLISHED Published: 2024-08-12T22:01:46.097Z Last Updated: 2024-08-14T19:55:10.112Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Averta Products: Depicter Slider Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.1.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/depicter/wordpress-slider-popup-builder-by-depicter-plugin-3-1-2-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43162 State: PUBLISHED Published: 2024-11-01T14:17:42.296Z Last Updated: 2024-11-01T19:38:43.170Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Easy Digital Downloads Products: Easy Digital Downloads Problem Types: CWE-862 Description: Missing Authorization vulnerability in Easy Digital Downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.2.12. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-broken-access-control-vulner
atabase/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2024-43163 State: PUBLISHED Published: 2024-08-12T21:57:49.037Z Last Updated: 2024-08-13T13:41:31.613Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Parcel Panel Products: ParcelPanel Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Parcel Panel ParcelPanel allows Reflected XSS.This issue affects ParcelPanel: from n/a through 4.3.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/parcelpanel/wordpress-parcelpanel-plugin-4-3-2-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43164 State: PUBLISHED Published: 2024-08-12T21:56:01.974Z Last Updated: 2024-08-13T15:52:04.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Blockspare Products: Blockspare Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Blockspare allows Stored XSS.This issue affects Blockspare: from n/a through 3.2.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/blockspare/wordpress-blockspare-plugin-3-2-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2024-43165 State: PUBLISHED Published: 2024-08-13T11:42:50.880Z Last Updated: 2024-08-13T13:05:35.202Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Rashid87 Products: WPSection Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Rashid87 WPSection allows PHP Local File Inclusion.This issue affects WPSection: from n/a through 1.3.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wpsection/wordpress-wpsection-plugin-1-3-8-contributor-limited-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2024-43166 State: PUBLISHED Published: 2025-09-03T09:10:24.401Z Last Updated: 2025-11-04T21:08:48.628Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-276 Description: Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/8zd69zkkx55qp365xp4tml1xh9og5lhk
CVE ID: CVE-2024-43167 State: PUBLISHED Published: 2024-08-08T20:24:49.932Z Last Updated: 2025-11-03T22:04:57.733Z Severity: LOW (CVSS 2.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 Problem Types: CWE-476 Description: DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the a
s by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A NULL pointer dereference flaw was found in the ub_ctx_set_fwd function in Unbound. This issue could allow an attacker who can invoke specific sequences of API calls to cause a segmentation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order,
tation fault. When certain API functions such as ub_ctx_set_fwd and ub_ctx_resolvconf are called in a particular order, the program attempts to read from a NULL pointer, leading to a crash. This issue can result in a denial of service by causing the application to terminate unexpectedly. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-43167 - https://bugzilla.redhat.com/show_bug.cgi?id=2303456 - https://github.com/NLnetLabs/unbound/issues/1072 - https://github.com/NLnetLabs/unbound/pull/1073/files
CVE ID: CVE-2024-43168 State: PUBLISHED Published: 2024-08-08T20:25:24.723Z Last Updated: 2025-11-03T22:04:59.198Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4, Red Hat OpenStack Platform 16.2, Red Hat OpenStack Platform 17.1, Red Hat OpenStack Platform 18.0 Problem Types: CWE-122 Description: DISPUTE NOTE: this issue does not pose a security risk as it (according to analysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of th
ysis by the original software developer, NLnet Labs) falls within the expected functionality and security controls of the application. Red Hat has made a claim that there is a security risk within Red Hat products. NLnet Labs has no further information about the claim, and suggests that affected Red Hat customers refer to available Red Hat documentation or support channels. ORIGINAL DESCRIPTION: A heap-buffer-overflow flaw was found in the cfg_mark_ports function within Unbound's config_file.c, which can lead to memory corruption. This issue could allow an attacker with local access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code ex
al access to provide specially crafted input, potentially causing the application to crash or allowing arbitrary code execution. This could result in a denial of service or unauthorized actions on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-43168 - https://bugzilla.redhat.com/show_bug.cgi?id=2303462 - https://github.com/NLnetLabs/unbound/issues/1039 - https://github.com/NLnetLabs/unbound/pull/1040/files
CVE ID: CVE-2024-43169 State: PUBLISHED Published: 2025-03-03T15:27:29.620Z Last Updated: 2025-09-01T01:10:55.594Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Engineering Requirements Management DOORS Next Problem Types: CWE-494 Description: IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a user to download a malicious file without verifying the integrity of the code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184506
CVE ID: CVE-2024-43173 State: PUBLISHED Published: 2024-10-22T14:48:21.218Z Last Updated: 2024-10-22T15:14:41.197Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-1275 Description: IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173596
CVE ID: CVE-2024-43176 State: PUBLISHED Published: 2025-01-09T14:03:37.176Z Last Updated: 2025-08-27T21:33:04.586Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: OpenPages Problem Types: CWE-282 Description: IBM OpenPages 9.0 could allow an authenticated user to obtain sensitive information such as configurations that should only be available to privileged users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174640
CVE ID: CVE-2024-43177 State: PUBLISHED Published: 2024-10-22T14:52:43.289Z Last Updated: 2024-10-22T15:17:45.001Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Concert Problem Types: CWE-295 Description: IBM Concert 1.0.0 and 1.0.1 vulnerable to attacks that rely on the use of cookies without the SameSite attribute. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173596
CVE ID: CVE-2024-43180 State: PUBLISHED Published: 2024-09-13T01:24:07.230Z Last Updated: 2024-09-13T13:50:26.818Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: IBM Products: Concert Problem Types: CWE-614 Description: IBM Concert 1.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pa
by snooping the traffic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168234 - https://exchange.xforce.ibmcloud.com/vulnerabilities/351213
CVE ID: CVE-2024-43184 State: PUBLISHED Published: 2025-09-04T15:04:57.324Z Last Updated: 2025-09-04T17:39:41.359Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Jazz Foundation Problem Types: CWE-79 Description: IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
edentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7244013
CVE ID: CVE-2024-43186 State: PUBLISHED Published: 2025-03-28T23:49:20.873Z Last Updated: 2025-09-01T01:00:28.126Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-256 Description: IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that is stored locally under certain conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184980
CVE ID: CVE-2024-43187 State: PUBLISHED Published: 2025-02-04T20:37:49.166Z Last Updated: 2025-02-22T20:57:40.762Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance, Security Verify Access Container Problem Types: CWE-319 Description: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182386
CVE ID: CVE-2024-43188 State: PUBLISHED Published: 2024-09-18T11:39:22.958Z Last Updated: 2024-09-18T16:40:53.717Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Business Automation Workflow Problem Types: CWE-602 Description: IBM Business Automation Workflow 22.0.2, 23.0.1, 23.0.2, and 24.0.0 could allow a privileged user to perform unauthorized activities due to improper client side validation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168769
CVE ID: CVE-2024-43189 State: PUBLISHED Published: 2024-11-15T14:51:54.421Z Last Updated: 2024-11-15T17:17:08.430Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-327 Description: IBM Concert Software 1.0.0 through 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173596
CVE ID: CVE-2024-43190 State: PUBLISHED Published: 2025-07-07T17:45:51.426Z Last Updated: 2025-08-24T11:31:35.546Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Requirements Management DOORS Problem Types: CWE-640 Description: IBM Engineering Requirements Management DOORS 9.7.2.9, under certain configurations, could allow a remote attacker to obtain password reset instructions of a legitimate user using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7238992
CVE ID: CVE-2024-43191 State: PUBLISHED Published: 2024-09-26T15:07:48.440Z Last Updated: 2024-09-26T15:51:05.670Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cloud Pak for Multicloud Management Problem Types: CWE-502 Description: IBM ManageIQ could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted yaml file request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7170411
CVE ID: CVE-2024-43192 State: PUBLISHED Published: 2025-09-27T01:14:43.143Z Last Updated: 2025-09-29T14:02:12.320Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Storage TS4500 Library Problem Types: CWE-352 Description: IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246245
CVE ID: CVE-2024-43196 State: PUBLISHED Published: 2025-02-20T03:42:12.195Z Last Updated: 2025-08-15T14:32:19.795Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-296 Description: IBM OpenPages with Watson 8.3 and 9.0 application could allow an authenticated user to manipulate data in the Questionnaires application allowing the user to spoof other users' responses. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-43199 State: PUBLISHED Published: 2024-08-07T00:00:00 Last Updated: 2024-09-13T17:05:22.655Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/NagiosEnterprises/ndoutils/pull/65 - https://github.com/NagiosEnterprises/ndoutils/commit/18ef12037f4a68772d6840cbaa08aa2da07d2891 - https://github.com/NagiosEnterprises/ndoutils/compare/ndoutils-2.1.3...ndoutils-2.1.4
CVE ID: CVE-2024-43201 State: PUBLISHED Published: 2024-09-23T19:11:39.193Z Last Updated: 2025-02-28T17:23:31.051Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Planet Fitness Products: Planet Fitness Workouts Problem Types: CWE-295 Description: The Planet Fitness Workouts iOS and Android mobile apps fail to properly validate TLS certificates, allowing an attacker with appropriate network access to obtain session tokens and sensitive information. Planet Fitness first addressed this vulnerability in version 9.8.12 (released on 2024-07-25) and more recently in version 9.9.13 (released on 2025-02-11). Additional Analyst Notes: - CISA ADP Vulnrichment: Reference
d more recently in version 9.9.13 (released on 2025-02-11). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://apps.apple.com/us/app/planet-fitness-workouts/id399857015 - https://dontvacuum.me/bugs/pf/