Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50271 State: PUBLISHED Published: 2023-12-17T14:49:53.516Z Last Updated: 2024-08-02T22:16:46.752Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: HPE Products: HPE System Management Homepage (SMH) Problem Types: CWE-200 Description: A potential security vulnerability has been identified with HP-UX System Management Homepage (SMH). This vulnerability could be exploited locally or remotely to disclose information. Additional Analyst Notes: - CVE Program Container: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbux04551en_us
CVE ID: CVE-2023-50272 State: PUBLISHED Published: 2023-12-19T15:42:21.932Z Last Updated: 2025-05-07T20:22:00.253Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Integrated Lights-out 5 (iLO 5), HPE Integrated Lights-out 6 (iLO 6), Description: A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbh
ner: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04584en_us
CVE ID: CVE-2023-50274 State: PUBLISHED Published: 2024-01-23T17:02:38.098Z Last Updated: 2025-05-30T14:19:09.185Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise Products: HPE OneView Description: HPE OneView may allow command injection with local privilege escalation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE ID: CVE-2023-50275 State: PUBLISHED Published: 2024-01-23T17:09:52.902Z Last Updated: 2025-06-20T18:53:32.458Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hewlett Packard Enterprise Products: HPE OneView Description: HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbgn04586en_us
CVE ID: CVE-2023-50290 State: PUBLISHED Published: 2024-01-15T09:32:44.532Z Last Updated: 2025-05-09T20:18:08.133Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java s
annot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess. The Solr Metrics API is protected by the "metrics-read" permission. Therefore, Solr Clouds with Authorization setup will only be vulnerable via users with the "metrics-read" permission. This issue affects Apache Solr: from 9.0.0 before 9.3.0. Users are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50290-apache-solr-al
am Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50290-apache-solr-allows-read-access-to-host-environment-variables
CVE ID: CVE-2023-50291 State: PUBLISHED Published: 2024-02-09T17:29:32.882Z Last Updated: 2025-05-15T19:39:09.044Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-522 Description: Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties that had "password" contained in the name. There are a number of sensitive system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published
e system properties, such as "basicauth" and "aws.secretKey" do not contain "password", thus their values were published via the "/admin/info/properties" endpoint. This endpoint populates the list of System Properties on the home screen of the Solr Admin page, making the exposed credentials visible in the UI. This /admin/info/properties endpoint is protected under the "config-read" permission. Therefore, Solr Clouds with Authorization enabled will only be vulnerable through logged-in users that have the "config-read" permission. Users are recommended to upgrade to version 9.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dso
.3.0 or 8.11.3, which fixes the issue. A single option now controls hiding Java system property for all endpoints, "-Dsolr.hiddenSysProps". By default all known sensitive properties are hidden (including "-Dbasicauth"), as well as any property with a name containing "secret" or "password". Users who cannot upgrade can also use the following Java system property to fix the issue: '-Dsolr.redaction.system.pattern=.*(password|secret|basicauth).*' Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies - http://www.op
2023-50291-apache-solr-can-leak-certain-passwords-due-to-system-property-redaction-logic-inconsistencies - http://www.openwall.com/lists/oss-security/2024/02/09/4
CVE ID: CVE-2023-50292 State: PUBLISHED Published: 2024-02-09T17:29:21.249Z Last Updated: 2025-05-15T19:39:15.762Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configure and test new Schemas and configSets. However, when the feature was created, the "trust" (authentication) of these configSets was not considered. External library loading is only available to
ted, the "trust" (authentication) of these configSets was not considered. External library loading is only available to configSets that are "trusted" (created by authenticated users), thus non-authenticated users are unable to perform Remote Code Execution. Since the Schema Designer loaded configSets without taking their "trust" into account, configSets that were created by unauthenticated users were allowed to load external libraries when used in the Schema Designer. Users are recommended to upgrade to version 9.3.0, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50298-apache-sol
rogram Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions - http://www.openwall.com/lists/oss-security/2024/02/09/3
CVE ID: CVE-2023-50293 State: REJECTED Published: N/A Last Updated: 2025-02-13T17:19:04.695Z Description: No description available.
CVE ID: CVE-2023-50294 State: PUBLISHED Published: 2023-12-26T07:21:19.831Z Last Updated: 2024-08-02T22:16:46.259Z Vendors: WESEEK, Inc. Products: GROWI Problem Types: Cleartext storage of sensitive information Description: The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page. Additional Analyst Notes: - CVE Program Container: References: - https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/ - https://jvn.jp/en/jp/JVN18715935/
CVE ID: CVE-2023-50297 State: PUBLISHED Published: 2023-12-26T05:53:48.253Z Last Updated: 2024-11-27T15:22:46.029Z Vendors: Alfasado Inc. Products: PowerCMS (PowerCMS 6 Series), PowerCMS (PowerCMS 5 Series), PowerCMS (PowerCMS 4 Series) Problem Types: Open Redirect Description: Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
by this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.powercms.jp/news/release-powercms-202312.html - https://jvn.jp/en/jp/JVN32646742/
CVE ID: CVE-2023-50298 State: PUBLISHED Published: 2024-02-09T17:29:07.889Z Last Updated: 2025-02-13T17:19:05.273Z Vendors: Apache Software Foundation Products: Apache Solr Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. Solr Streaming Expressions allows users to extract data from other Solr Clouds, using a "zkHost" parameter. When original SolrCloud is setup to use ZooKeeper credentials and ACLs, they will be sent to whatever "zkHost" the user provides. An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper reques
o whatever "zkHost" the user provides. An attacker could setup a server to mock ZooKeeper, that accepts ZooKeeper requests with credentials and ACLs and extracts the sensitive information, then send a streaming expression using the mock server's address in "zkHost". Streaming Expressions are exposed via the "/streaming" handler, with "read" permissions. Users are recommended to upgrade to version 8.11.3 or 9.4.1, which fix the issue. From these versions on, only zkHost values that have the same server address (regardless of chroot), will use the given ZooKeeper credentials and ACLs when connecting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
and ACLs when connecting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://solr.apache.org/security.html#cve-2023-50298-apache-solr-can-expose-zookeeper-credentials-via-streaming-expressions - http://www.openwall.com/lists/oss-security/2024/02/09/3 - http://www.openwall.com/lists/oss-security/2024/02/09/2
CVE ID: CVE-2023-50300 State: PUBLISHED Published: 2025-10-01T17:07:03.199Z Last Updated: 2025-10-01T17:20:10.862Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Transformation Extender Advanced Problem Types: CWE-284 Description: IBM Transformation Extender Advanced 10.0.1 could allow a local user to perform unauthorized actions due to improper access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246882
CVE ID: CVE-2023-50301 State: PUBLISHED Published: 2025-10-01T15:15:05.897Z Last Updated: 2025-10-15T16:09:37.429Z Severity: LOW (CVSS 1.9 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Transformation Extender Advanced Problem Types: CWE-532 Description: IBM Transformation Extender Advanced 10.0.1 stores potentially sensitive information in log files that could be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7246882
CVE ID: CVE-2023-50303 State: PUBLISHED Published: 2024-02-28T00:10:22.262Z Last Updated: 2024-08-02T22:16:46.548Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-79 Description: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273333. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node
al Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7116120 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273333
CVE ID: CVE-2023-50304 State: PUBLISHED Published: 2024-07-18T16:01:38.174Z Last Updated: 2024-08-02T22:16:46.319Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Engineering Requirements Management DOORS Problem Types: CWE-611 Description: IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 273335. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages
itional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7160471 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273335
CVE ID: CVE-2023-50305 State: PUBLISHED Published: 2024-03-01T01:44:34.005Z Last Updated: 2024-08-02T22:16:46.041Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Requirements Management Problem Types: CWE-521 Description: IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 273336. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7124058 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273336
CVE ID: CVE-2023-50306 State: PUBLISHED Published: 2024-02-20T13:51:27.061Z Last Updated: 2024-08-02T22:16:46.620Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Common Licensing Problem Types: CWE-204 Description: IBM Common Licensing 9.0 could allow a local user to enumerate usernames due to an observable response discrepancy. IBM X-Force ID: 273337. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7120660 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273337
CVE ID: CVE-2023-50307 State: PUBLISHED Published: 2024-04-12T02:30:56.429Z Last Updated: 2024-08-02T22:16:46.342Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.0.3.9, 6.1.0.0 through 6.1.2.3, and 6.2.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 273338. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
ted session. IBM X-Force ID: 273338. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7148015 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273338
CVE ID: CVE-2023-50308 State: PUBLISHED Published: 2024-01-22T18:44:56.572Z Last Updated: 2025-06-10T16:03:52.620Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-20 Description: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables. IBM X-Force ID: 273393. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105506 - https://exchange.xforce.ibmcloud.com/
A ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105506 - https://exchange.xforce.ibmcloud.com/vulnerabilities/273393 - https://security.netapp.com/advisory/ntap-20240307-0001/
CVE ID: CVE-2023-50309 State: PUBLISHED Published: 2025-01-23T02:38:25.105Z Last Updated: 2025-01-23T14:46:55.872Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Standard Edition Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/71760
d session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176082
CVE ID: CVE-2023-50310 State: PUBLISHED Published: 2024-10-23T10:55:53.145Z Last Updated: 2024-10-23T13:45:26.181Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: CICS Transaction Gateway for Multiplatforms Problem Types: CWE-522 Description: IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7145418
CVE ID: CVE-2023-50311 State: PUBLISHED Published: 2024-03-31T12:00:11.233Z Last Updated: 2024-10-23T10:59:46.860Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: CICS Transaction Gateway for Multiplatforms Problem Types: CWE-522 Description: IBM CICS Transaction Gateway for Multiplatforms 9.2 and 9.3 could disclose sensitive path information to an attacker that could reveal through debugging or error messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://https://www.ibm.com/support/pages/node/7145418
CVE ID: CVE-2023-50312 State: PUBLISHED Published: 2024-03-01T02:30:11.542Z Last Updated: 2025-04-22T15:44:05.400Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Liberty Problem Types: CWE-327 Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7125527 - https://exchange.xforce.ibmcloud.com/vulnerabilities/274711
CVE ID: CVE-2023-50313 State: PUBLISHED Published: 2024-04-02T12:54:31.145Z Last Updated: 2024-08-02T22:16:46.340Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-327 Description: IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145620 - https://exchange.xforce.ibmcloud.com/vulnerabilities/274812
CVE ID: CVE-2023-50314 State: PUBLISHED Published: 2024-08-14T17:22:31.591Z Last Updated: 2024-08-19T16:05:25.204Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Liberty Problem Types: CWE-295 Description: IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.8 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274713. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165502 - https://ex
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165502 - https://exchange.xforce.ibmcloud.com/vulnerabilities/274713
CVE ID: CVE-2023-50315 State: PUBLISHED Published: 2024-08-14T17:04:49.881Z Last Updated: 2024-08-14T17:43:47.744Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-295 Description: IBM WebSphere Application Server 8.5 and 9.0 could allow an attacker with access to the network to conduct spoofing attacks. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information. IBM X-Force ID: 274714. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165511 - https://exchange.xforce.ibmcloud.
CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165511 - https://exchange.xforce.ibmcloud.com/vulnerabilities/274714
CVE ID: CVE-2023-50316 State: PUBLISHED Published: 2025-01-28T00:22:53.423Z Last Updated: 2025-01-28T15:17:53.763Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-89 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7176072
CVE ID: CVE-2023-50324 State: PUBLISHED Published: 2024-03-01T01:58:09.921Z Last Updated: 2024-08-02T22:16:46.252Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Command Center Problem Types: CWE-200 Description: IBM Cognos Command Center 10.2.4.1 and 10.2.5 exposes details the X-AspNet-Version Response Header that could allow an attacker to obtain information of the application environment to conduct further attacks. IBM X-Force ID: 275038. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7112504 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275038
CVE ID: CVE-2023-50326 State: PUBLISHED Published: 2024-02-02T00:01:32.137Z Last Updated: 2024-08-02T22:16:46.239Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-307 Description: IBM PowerSC 1.3, 2.0, and 2.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 275107. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275107