Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-27843 State: PUBLISHED Published: 2023-04-25T00:00:00.000Z Last Updated: 2025-02-03T19:43:48.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesProduct::deleteProduct component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/quotes/3725-ask-for-a-quote-convert-to-order-messaging-system.html - https://friends-of-presta.github.io/security-advisories/modules/2023/04/25/askforaquote.html
CVE ID: CVE-2023-27844 State: PUBLISHED Published: 2023-04-17T00:00:00.000Z Last Updated: 2025-02-06T15:14:03.304Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::getController component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://litextension.com/migration-services/seo-urls-migrations.html#page%232 - https://friends-of-presta.github.io/security-advisories/modules/2023/04/13/leurlrewrite.html
CVE ID: CVE-2023-27845 State: PUBLISHED Published: 2023-07-07T00:00:00 Last Updated: 2024-11-13T21:07:08.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop lekerawen_ocs before v.1.4.1 allow a remote attacker to gain privileges via the KerawenHelper::setCartOperationInfo, and KerawenHelper::resetCheckoutSessionData components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kerawen.com/logiciel-de-caisse/ - https://security.friendsofpresta.org/modules/2023/07/06/kerawen_ocs.html
CVE ID: CVE-2023-27846 State: PUBLISHED Published: 2023-10-31T00:00:00 Last Updated: 2024-09-05T20:12:34.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcmswishlist, tvcmsbrandlist, tvcmscategorychainslider, tvcmscategoryproduct, tvcmscategoryslider, tvcmspaymenticon, tvcmstestimonial components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.friendsofpresta.org/modules/2023/10/25/tvcmsblog.html
CVE ID: CVE-2023-27847 State: PUBLISHED Published: 2023-03-27T00:00:00.000Z Last Updated: 2025-02-19T15:31:29.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xpert-idea/xipblog/ - https://friends-of-presta.github.io/security-advisories/modules/2023/03/23/xipblog.html
CVE ID: CVE-2023-27848 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-05T15:41:47.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/broccoli-compass - https://github.com/omnitaint/Vulnerability-Reports/blob/9d65add2bca71ed6d6b2e281ee6790a12504ff8e/reports/broccoli-compass/report.md
CVE ID: CVE-2023-27849 State: PUBLISHED Published: 2023-04-24T00:00:00.000Z Last Updated: 2025-02-04T21:05:03.098Z Vendors: n/a Products: n/a Problem Types: n/a Description: rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/rails-routes-to-json - https://github.com/omnitaint/Vulnerability-Reports/blob/2211ea4712f24d20b7f223fb737910fdfb041edb/reports/rails-routes-to-json/report.md
CVE ID: CVE-2023-27850 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-28T16:47:30.961Z Vendors: n/a Products: NETGEAR Nighthawk WiFi6 Router Problem Types: Improper Link Resolution Before File Access Description: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to access arbitrary files on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-9
CVE ID: CVE-2023-27851 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T21:35:18.213Z Vendors: n/a Products: NETGEAR Nighthawk WiFi6 Router Problem Types: Code Execution Description: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users with upload permissions to execute arbitrary code on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-9
CVE ID: CVE-2023-27852 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T20:15:34.219Z Vendors: n/a Products: NETGEAR Nighthawk WiFi6 Router Problem Types: Code Execution Description: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an attacker to execute arbitrary code on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-9
CVE ID: CVE-2023-27853 State: PUBLISHED Published: 2023-03-10T00:00:00.000Z Last Updated: 2025-02-27T21:26:45.212Z Vendors: n/a Products: NETGEAR Nighthawk WiFi6 Router Problem Types: Code Execution Description: NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://tenable.com/security/research/tra-2023-9
CVE ID: CVE-2023-27854 State: PUBLISHED Published: 2023-10-27T18:51:30.505Z Last Updated: 2024-09-10T14:26:35.022Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-125 Description: An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unauthorized arbitrary code to the software by using a memory buffer overflow. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file prov
cting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
CVE ID: CVE-2023-27855 State: PUBLISHED Published: 2023-03-21T23:48:11.750Z Last Updated: 2025-02-25T20:21:14.120Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: ThinManager ThinServer Problem Types: CWE-22 Description: In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially cau
ed. The attacker could overwrite existing executable files with attacker-controlled, malicious contents, potentially causing remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640
CVE ID: CVE-2023-27856 State: PUBLISHED Published: 2023-03-21T23:55:23.665Z Last Updated: 2025-02-25T21:22:03.982Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Rockwell Automation Products: ThinManager ThinServer Problem Types: CWE-22 Description: In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.exe is installed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640
CVE ID: CVE-2023-27857 State: PUBLISHED Published: 2023-03-22T00:00:18.344Z Last Updated: 2024-10-21T16:02:48.552Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: ThinManager ThinServer Problem Types: CWE-125 Description: In affected versions, a heap-based buffer over-read condition occurs when the message field indicates more data than is present in the message field in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
read access violation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1138640
CVE ID: CVE-2023-27858 State: PUBLISHED Published: 2023-10-27T18:58:26.703Z Last Updated: 2024-09-09T19:48:57.646Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Arena Simulation Problem Types: CWE-824 Description: Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized code to the software by using an uninitialized pointer in the application. The threat-actor could then execute malicious code on the system affecting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provi
ting the confidentiality, integrity, and availability of the product. The user would need to open a malicious file provided to them by the attacker for the code to execute. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1141145
CVE ID: CVE-2023-27859 State: PUBLISHED Published: 2024-01-22T20:02:02.789Z Last Updated: 2025-06-20T18:36:00.655Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Description: IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existing like named jar file in another database. IBM X-Force ID: 249205. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105503 -
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105503 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249205 - https://security.netapp.com/advisory/ntap-20240307-0002/
CVE ID: CVE-2023-27860 State: PUBLISHED Published: 2023-04-27T18:59:24.744Z Last Updated: 2025-01-30T20:48:54.976Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-209 Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6985679 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249207
CVE ID: CVE-2023-27861 State: PUBLISHED Published: 2023-06-05T00:23:57.700Z Last Updated: 2025-01-08T16:49:13.737Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Maximo Application Suite Problem Types: CWE-319 Description: IBM Maximo Application Suite - Manage Component 8.8.0 and 8.9.0 transmits sensitive information in cleartext that could be intercepted by an attacker using man in the middle techniques. IBM X-Force ID: 249208. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999917 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249208
CVE ID: CVE-2023-27863 State: PUBLISHED Published: 2023-05-12T18:27:59.211Z Last Updated: 2025-01-23T20:18:13.220Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Spectrum Protect Plus Server Problem Types: CWE-200 Description: IBM Spectrum Protect Plus Server 10.1.13, under specific configurations, could allow an elevated user to obtain SMB credentials that may be used to access vSnap data stores. IBM X-Force ID: 249325. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6965812 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249325
CVE ID: CVE-2023-27864 State: PUBLISHED Published: 2023-04-28T17:01:04.242Z Last Updated: 2025-01-30T19:24:51.336Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 249327. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
ting site. IBM X-Force ID: 249327. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6983460 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249327
CVE ID: CVE-2023-27866 State: PUBLISHED Published: 2023-06-28T15:41:11.062Z Last Updated: 2024-10-28T13:02:31.778Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Informix JDBC Problem Types: CWE-94 Description: IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7007615 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249511
CVE ID: CVE-2023-27867 State: PUBLISHED Published: 2023-07-08T18:43:58.232Z Last Updated: 2025-02-13T16:45:35.158Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-94 Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code via JNDI Injection. By sending a specially crafted request using the property clientRerouteServerListJNDIName, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249514. Additional Analyst Notes: - CVE Program Container: - C
to execute arbitrary code on the system. IBM X-Force ID: 249514. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249514 - https://security.netapp.com/advisory/ntap-20230803-0006/
CVE ID: CVE-2023-27868 State: PUBLISHED Published: 2023-07-08T18:46:16.208Z Last Updated: 2025-02-13T16:45:35.702Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-94 Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked class instantiation when providing plugin classes. By sending a specially crafted request using the named pluginClassName class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516
Name class, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249516. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249516 - https://security.netapp.com/advisory/ntap-20230803-0006/
CVE ID: CVE-2023-27869 State: PUBLISHED Published: 2023-07-08T18:40:10.686Z Last Updated: 2025-02-13T16:45:36.261Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-94 Description: IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517. Additional Analyst Notes: - CVE Pr
t this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010029 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249517 - https://security.netapp.com/advisory/ntap-20230803-0006/
CVE ID: CVE-2023-27870 State: PUBLISHED Published: 2023-05-11T19:36:23.223Z Last Updated: 2025-01-24T16:11:20.398Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Spectrum Virtualize Problem Types: CWE-200 Description: IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/249518 - https://www.ibm.com/support/pages/node/6985697
CVE ID: CVE-2023-27871 State: PUBLISHED Published: 2023-03-21T14:29:53.076Z Last Updated: 2025-02-25T20:03:41.068Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: 208 Information Exposure Through Timing Discrepancy Description: IBM Aspera Faspex 4.4.2 could allow a remote attacker to obtain sensitive credential information for an external user, using a specially crafted SQL query. IBM X-Force ID: 249613. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964694 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249613
CVE ID: CVE-2023-27873 State: PUBLISHED Published: 2023-03-21T14:37:03.988Z Last Updated: 2025-02-26T16:48:57.047Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: 200 Description: IBM Aspera Faspex 4.4.2 could allow a remote authenticated attacker to obtain sensitive credential information using specially crafted XML input. IBM X-Force ID: 249654. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964694 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249654
CVE ID: CVE-2023-27874 State: PUBLISHED Published: 2023-03-21T14:33:20.252Z Last Updated: 2025-02-26T16:50:16.930Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-611 Description: IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6964694 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249845
CVE ID: CVE-2023-27875 State: PUBLISHED Published: 2023-03-16T12:37:09.318Z Last Updated: 2025-02-26T15:06:45.141Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: 284 Improper Access Control Description: IBM Aspera Faspex 5.0.4 could allow a user to change other user's credentials due to improper access controls. IBM X-Force ID: 249847. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6963662 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249847
CVE ID: CVE-2023-27876 State: PUBLISHED Published: 2023-04-07T13:19:32.681Z Last Updated: 2025-02-10T15:21:41.965Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: TRIRIGA Application Platform Problem Types: CWE-611 Description: IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249975. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6981115 - https://exchange.xforce.ibmcloud.com/vulnerabi
nrichment: References: - https://www.ibm.com/support/pages/node/6981115 - https://exchange.xforce.ibmcloud.com/vulnerabilities/249975
CVE ID: CVE-2023-27877 State: PUBLISHED Published: 2023-07-19T01:31:33.738Z Last Updated: 2024-10-28T15:03:51.139Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Planning Analytics Cartridge for Cloud Pak for Data Problem Types: CWE-200 Description: IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999351 - https://exchange.xfor
Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/6999351 - https://exchange.xforce.ibmcloud.com/vulnerabilities/247905