Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-31852 State: PUBLISHED Published: 2024-04-05T00:00:00 Last Updated: 2024-12-04T21:06:04.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can sometimes be an exploitable error in the flow of control. This affects the ARM backend and can be demonstrated with Clang. NOTE: the vendor perspective is "we don't have strong objections for a CVE to be created ... It does seem that the likelihood of this miscompile enabling an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most lik
g an exploit remains very low, because the miscompile resulting in this JOP gadget is such that the function is most likely to crash on most valid inputs to the function. So, if this function is covered by any testing, the miscompile is most likely to be discovered before the binary is shipped to production." Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/llvm/llvm-project/issues/80287 - https://llvm.org/docs/Security.html - https://bugs.chromium.org/p/llvm/issues/detail?id=69 - https://github.com/llvmbot/llvm-project/commit/0e16af8e4cf3a66ad5d078d52744ae2776f9c4b2
CVE ID: CVE-2024-31853 State: PUBLISHED Published: 2025-07-08T10:34:21.527Z Last Updated: 2025-07-08T16:12:08.292Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SICAM TOOLBOX II Problem Types: CWE-295 Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed device, the affected application doesn't check the extended key usage attribute of that device's certificate. This could allow an attacker to execute an on-path network (MitM) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.co
h network (MitM) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-183963.html
CVE ID: CVE-2024-31854 State: PUBLISHED Published: 2025-07-08T10:34:22.862Z Last Updated: 2025-07-08T16:11:59.998Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Siemens Products: SICAM TOOLBOX II Problem Types: CWE-295 Description: A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11). During establishment of a https connection to the TLS server of a managed device, the affected application doesn't check device's certificate common name against an expected value. This could allow an attacker to execute an on-path network (MitM) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/p
etwork (MitM) attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-183963.html
CVE ID: CVE-2024-31856 State: PUBLISHED Published: 2024-05-15T19:52:37.407Z Last Updated: 2024-08-02T01:59:49.843Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: CyberPower Products: PowerPanel business Problem Types: CWE-89 Description: An attacker with certain MQTT permissions can create malicious messages to all CyberPower PowerPanel devices. This could result in an attacker injecting SQL syntax, writing arbitrary files to the system, and executing remote code. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/produc
ferences: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01 - https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
CVE ID: CVE-2024-31857 State: PUBLISHED Published: 2024-04-23T04:46:50.478Z Last Updated: 2024-08-02T01:59:49.388Z Vendors: WPMU DEV Products: Forminator Problem Types: Cross-site scripting (XSS) Description: Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wordpress.org/plugins/forminator/ - https://wpmudev.com/ - https://jvn.jp/en/jp/JVN50132400/
CVE ID: CVE-2024-31858 State: PUBLISHED Published: 2025-02-12T21:16:05.753Z Last Updated: 2025-02-26T04:55:39.452Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) QuickAssist Technology software Problem Types: Escalation of Privilege, CWE-787 Description: Out-of-bounds write for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01124.html
CVE ID: CVE-2024-31859 State: PUBLISHED Published: 2024-05-26T13:31:42.704Z Last Updated: 2024-08-02T01:59:49.900Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-284 Description: Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1 and 8.1.x <= 8.1.12 fail to perform proper authorization checks which allows a member running a playbook in an existing channel to be promoted to a channel admin Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://mattermost.com/security-updates
CVE ID: CVE-2024-31860 State: PUBLISHED Published: 2024-04-09T09:08:28.802Z Last Updated: 2025-05-06T13:12:31.467Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-22 Description: Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicators(E.g ..), attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4632 - https://lis
CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4632 - https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x
CVE ID: CVE-2024-31861 State: REJECTED Published: 2024-04-11T08:19:58.929Z Last Updated: 2024-06-21T09:07:03.255Z Description: No description available.
CVE ID: CVE-2024-31862 State: PUBLISHED Published: 2024-04-09T09:40:39.495Z Last Updated: 2025-02-13T17:48:04.941Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/zeppelin/pull/4632 - https://lists.apache.org/thread/73xdjx43yg4yz8bd4p3o8vzyybkysmn0 - http://www.openwall.com/lists/oss-security/
ll/4632 - https://lists.apache.org/thread/73xdjx43yg4yz8bd4p3o8vzyybkysmn0 - http://www.openwall.com/lists/oss-security/2024/04/09/5
CVE ID: CVE-2024-31863 State: PUBLISHED Published: 2024-04-09T10:25:29.449Z Last Updated: 2025-03-25T18:21:05.668Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-290 Description: Authentication Bypass by Spoofing vulnerability by replacing to exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0. Users are recommended to upgrade to version 0.11.0, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/3od2gfpwllmtc9c5ggw04ohn8s7w3ct9 - http://www.openwall.com/lists/oss-security/2024/04/09/6
CVE ID: CVE-2024-31864 State: PUBLISHED Published: 2024-04-09T16:05:32.690Z Last Updated: 2025-11-04T21:08:35.546Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-94 Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4709 - https://www.cve.org
Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4709 - https://www.cve.org/CVERecord?id=CVE-2020-11974 - https://lists.apache.org/thread/752qdk0rnkd9nqtornz734zwb7xdwcdb - http://www.openwall.com/lists/oss-security/2024/04/09/8
CVE ID: CVE-2024-31865 State: PUBLISHED Published: 2024-04-09T16:07:36.358Z Last Updated: 2025-02-13T17:48:06.867Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can call updating cron API with invalid or improper privileges so that the notebook can run with the privileges. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4631 - https://lists.apache.org/th
hment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4631 - https://lists.apache.org/thread/slm1sf0slwc11f4m4r0nd6ot2rf7w81l - http://www.openwall.com/lists/oss-security/2024/04/09/9
CVE ID: CVE-2024-31866 State: PUBLISHED Published: 2024-04-09T16:09:12.117Z Last Updated: 2025-02-13T17:51:59.550Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-116 Description: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELIN_INTP_CLASSPATH_OVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/zeppelin/pull/4715 - https://lists
E Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/zeppelin/pull/4715 - https://lists.apache.org/thread/jpkbq3oktopt34x2n5wnhzc2r1410ddd - http://www.openwall.com/lists/oss-security/2024/04/09/10
CVE ID: CVE-2024-31867 State: PUBLISHED Published: 2024-04-09T16:15:47.978Z Last Updated: 2025-02-13T17:52:00.183Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-20 Description: Improper Input Validation vulnerability in Apache Zeppelin. The attackers can execute malicious queries by setting improper configuration properties to LDAP search filter. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4714 - https://lists.apache.org/thread/s4scw8bxdh
ogram Container: References: - https://github.com/apache/zeppelin/pull/4714 - https://lists.apache.org/thread/s4scw8bxdhrjs0kg0lhb68xqd8y9lrtf - http://www.openwall.com/lists/oss-security/2024/04/09/12
CVE ID: CVE-2024-31868 State: PUBLISHED Published: 2024-04-09T16:10:30.671Z Last Updated: 2024-11-04T16:12:40.294Z Vendors: Apache Software Foundation Products: Apache Zeppelin Problem Types: CWE-79 Description: Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can modify helium.json and exposure XSS attacks to normal users. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/zeppelin/pull/4728 - https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftplly
ferences: - https://github.com/apache/zeppelin/pull/4728 - https://lists.apache.org/thread/55mqs673plsxmgnq7fdf2flftpllyf11
CVE ID: CVE-2024-31869 State: PUBLISHED Published: 2024-04-18T07:19:05.033Z Last Updated: 2025-03-13T16:10:23.130Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-4
2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/apache/airflow/pull/38795 - https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3 - http://www.openwall.com/lists/oss-security/2024/04/17/10
CVE ID: CVE-2024-31870 State: PUBLISHED Published: 2024-06-15T13:47:19.126Z Last Updated: 2024-08-22T18:03:12.936Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: i Problem Types: CWE-204 Description: IBM Db2 for i 7.2, 7.3, 7.4, and 7.5 supplies user defined table function is vulnerable to user enumeration by a local authenticated attacker, without having authority to the related *USRPRF objects. This can be used by a malicious actor to gather information about users that can be targeted in further attacks. IBM X-Force ID: 287174. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support
4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7157638 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287174
CVE ID: CVE-2024-31871 State: PUBLISHED Published: 2024-04-10T15:55:20.179Z Last Updated: 2025-11-03T21:54:42.865Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Appliance Problem Types: CWE-295 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts due to improper certificate validation. IBM X-Force ID: 287306. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147932 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287306
CVE ID: CVE-2024-31872 State: PUBLISHED Published: 2024-04-10T15:51:04.118Z Last Updated: 2025-11-03T21:54:44.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Appliance Problem Types: CWE-295 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147932 - https://exchange.xforce.ibmcloud.com/vulnerabilities/28731
eferences: - https://www.ibm.com/support/pages/node/7147932 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287316
CVE ID: CVE-2024-31873 State: PUBLISHED Published: 2024-04-10T15:58:42.588Z Last Updated: 2025-11-03T21:54:45.878Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance Problem Types: CWE-798 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtained by a malicious actor. IBM X-Force ID: 287317. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147932 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287317
CVE ID: CVE-2024-31874 State: PUBLISHED Published: 2024-04-10T16:02:21.365Z Last Updated: 2025-11-03T21:54:47.335Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Access Appliance Problem Types: CWE-457 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of service. IBM X-Force ID: 287318. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147932 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287318
CVE ID: CVE-2024-31878 State: PUBLISHED Published: 2024-06-07T13:21:52.509Z Last Updated: 2024-08-02T01:59:50.086Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: i Problem Types: CWE-203 Description: IBM i 7.2, 7.3, 7.4, and 7.5 Service Tools Server (SST) is vulnerable to SST user enumeration by a remote attacker. This vulnerability can be used by a malicious actor to gather information about SST users that can be targeted in further attacks. IBM X-Force ID: 287538. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156725 - https://exchange.xforce.ibmcloud.com/vuln
gram Container: References: - https://www.ibm.com/support/pages/node/7156725 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287538
CVE ID: CVE-2024-31879 State: PUBLISHED Published: 2024-05-18T15:40:03.867Z Last Updated: 2024-08-02T01:59:49.831Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: i Problem Types: CWE-502 Description: IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the deserialization of untrusted data. IBM X-Force ID: 287539. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7154380 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287539
CVE ID: CVE-2024-31880 State: PUBLISHED Published: 2024-10-23T01:09:30.580Z Last Updated: 2025-11-04T16:12:04.894Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-770 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service, under specific configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156851
CVE ID: CVE-2024-31881 State: PUBLISHED Published: 2024-06-12T18:21:45.458Z Last Updated: 2025-11-04T16:12:05.861Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-770 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash when using a specially crafted query on certain columnar tables by an authenticated user. IBM X-Force ID: 287613. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156852 - https://exchange.xfo
lnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7156852 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287613
CVE ID: CVE-2024-31882 State: PUBLISHED Published: 2024-08-14T17:46:48.338Z Last Updated: 2025-11-04T16:12:06.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-943 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to a denial of service, under specific non default configurations, as the server may crash when using a specially crafted SQL statement by an authenticated user. IBM X-Force ID: 287614. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7165338 - ht
tes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7165338 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287614
CVE ID: CVE-2024-31883 State: PUBLISHED Published: 2024-06-27T15:50:52.220Z Last Updated: 2024-08-02T01:59:50.071Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security Verify Access Problem Types: CWE-703 Description: IBM Security Verify Access 10.0.0.0 through 10.0.7.1, under certain configurations, could allow an unauthenticated attacker to cause a denial of service due to asymmetric resource consumption. IBM X-Force ID: 287615. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158789 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287615
CVE ID: CVE-2024-31887 State: PUBLISHED Published: 2024-04-16T21:18:19.012Z Last Updated: 2024-08-02T01:59:50.153Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Privilege Problem Types: CWE-497 Description: IBM Security Verify Privilege 11.6.25 could allow an unauthenticated actor to obtain sensitive information from the SOAP API. IBM X-Force ID: 287651. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7148438 - https://exchange.xforce.ibmcloud.com/vulnerabilities/287651
CVE ID: CVE-2024-31889 State: PUBLISHED Published: 2024-05-31T12:57:26.223Z Last Updated: 2024-08-02T01:59:50.666Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-79 Description: IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 288136. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/71
Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7151122 - https://exchange.xforce.ibmcloud.com/vulnerabilities/288136