Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
read or modify information. There is no impact on availability of application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3468102 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41733 State: PUBLISHED Published: 2024-08-13T03:52:25.523Z Last Updated: 2024-08-13T14:48:19.091Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Commerce Problem Types: CWE-200 Description: In SAP Commerce, valid user accounts can be identified during the customer registration and login processes. This allows a potential attacker to learn if a given e-mail is used for an account, but does not grant access to any customer data beyond this knowledge. The attacker must already know the e-mail that they wish to test for. The impact on confidentiality therefore is low and no impact to integrity or availability Additional Ana
sh to test for. The impact on confidentiality therefore is low and no impact to integrity or availability Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3471450 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41734 State: PUBLISHED Published: 2024-08-13T04:18:03.596Z Last Updated: 2024-08-13T14:38:41.935Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP NetWeaver Application Server ABAP and ABAP Platform Problem Types: CWE-862 Description: Due to missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform, an authenticated attacker could call an underlying transaction, which leads to disclosure of user related information. There is no impact on integrity or availability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3494349 - https://url.sap/sapsecuritypatc
Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3494349 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41735 State: PUBLISHED Published: 2024-08-13T03:49:48.215Z Last Updated: 2024-08-13T14:44:24.355Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: SAP_SE Products: SAP Commerce Backoffice Problem Types: CWE-79 Description: SAP Commerce Backoffice does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability causing low impact on confidentiality and integrity of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3483256 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41736 State: PUBLISHED Published: 2024-08-13T04:09:24.579Z Last Updated: 2024-08-13T13:27:46.182Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP Permit to Work Problem Types: CWE-200 Description: Under certain conditions SAP Permit to Work allows an authenticated attacker to access information which would otherwise be restricted causing low impact on the confidentiality of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3475427 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41737 State: PUBLISHED Published: 2024-08-13T03:55:04.128Z Last Updated: 2024-08-14T16:43:20.026Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: SAP_SE Products: SAP CRM ABAP (Insights Management) Problem Types: CWE-918 Description: SAP CRM ABAP (Insights Management) allows an authenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on integrity and availability of the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3487537 - https://url.sap/sapsecu
itional Analyst Notes: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3487537 - https://url.sap/sapsecuritypatchday
CVE ID: CVE-2024-41738 State: PUBLISHED Published: 2024-11-01T16:36:39.955Z Last Updated: 2024-11-01T17:25:09.421Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: TXSeries for Multiplatforms Problem Types: CWE-598 Description: IBM TXSeries for Multiplatforms 10.1 could allow an attacker to obtain sensitive information from the query string of an HTTP GET method to process a request which could be obtained using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174572
CVE ID: CVE-2024-41739 State: PUBLISHED Published: 2025-01-24T13:37:20.678Z Last Updated: 2025-01-27T14:55:04.717Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cognos Dashboards on Cloud Pak for Data Problem Types: CWE-427 Description: IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177766
CVE ID: CVE-2024-41741 State: PUBLISHED Published: 2024-11-01T16:40:49.569Z Last Updated: 2024-11-01T17:24:30.450Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: TXSeries for Multiplatforms Problem Types: CWE-208 Description: IBM TXSeries for Multiplatforms 10.1 could allow an attacker to determine valid usernames due to an observable timing discrepancy which could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174572
CVE ID: CVE-2024-41742 State: PUBLISHED Published: 2025-01-19T15:03:26.761Z Last Updated: 2025-01-21T15:05:01.187Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: TXSeries for Multiplatforms Problem Types: CWE-770 Description: IBM TXSeries for Multiplatforms 10.1 is vulnerable to a denial of service, caused by improper enforcement of the timeout on individual read operations. By conducting a slowloris-type attacks, a remote attacker could exploit this vulnerability to cause a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172103
CVE ID: CVE-2024-41743 State: PUBLISHED Published: 2025-01-19T15:02:53.897Z Last Updated: 2025-01-21T15:05:23.797Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: TXSeries for Multiplatforms Problem Types: CWE-770 Description: IBM TXSeries for Multiplatforms 10.1 could allow a remote attacker to cause a denial of service using persistent connections due to improper allocation of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172103
CVE ID: CVE-2024-41744 State: PUBLISHED Published: 2024-11-01T16:53:32.755Z Last Updated: 2024-11-01T17:22:23.878Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: CICS TX Standard Problem Types: IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Description: IBM CICS TX Standard 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
thorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174576
CVE ID: CVE-2024-41745 State: PUBLISHED Published: 2024-11-01T16:48:49.374Z Last Updated: 2024-11-01T17:23:58.422Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Standard Problem Types: CWE-79 Description: IBM CICS TX Standard is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174576
CVE ID: CVE-2024-41746 State: PUBLISHED Published: 2025-01-16T17:13:53.888Z Last Updated: 2025-01-16T19:02:43.688Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: CICS TX Advanced, CICS TX Standard Problem Types: CWE-79 Description: IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7171873
CVE ID: CVE-2024-41750 State: PUBLISHED Published: 2025-07-23T11:15:12.334Z Last Updated: 2025-08-18T01:29:21.637Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: SmartCloud Analytics Log Analysis Problem Types: CWE-602 Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240264
CVE ID: CVE-2024-41751 State: PUBLISHED Published: 2025-07-23T11:09:44.485Z Last Updated: 2025-08-18T01:29:44.858Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: SmartCloud Analytics Log Analysis Problem Types: CWE-602 Description: IBM SmartCloud Analytics - Log Analysis 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2 could allow a local, authenticated attacker to bypass client-side enforcement of security to manipulate data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7240255
CVE ID: CVE-2024-41752 State: PUBLISHED Published: 2024-12-18T16:07:14.012Z Last Updated: 2024-12-18T19:37:04.686Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-80 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177223
CVE ID: CVE-2024-41753 State: PUBLISHED Published: 2025-05-03T16:06:18.716Z Last Updated: 2025-08-28T14:28:03.413Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-79 Description: IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7232197
CVE ID: CVE-2024-41757 State: PUBLISHED Published: 2025-01-24T15:14:50.440Z Last Updated: 2025-09-29T15:13:21.541Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Concert Software Problem Types: CWE-319 Description: IBM Concert Software 1.0.0 and 1.0.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173596
CVE ID: CVE-2024-41760 State: PUBLISHED Published: 2025-03-11T00:49:35.514Z Last Updated: 2025-09-01T01:06:28.288Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Common Cryptographic Architecture, 4769 Developers Toolkit Problem Types: CWE-203 Description: IBM Common Cryptographic Architecture 7.0.0 through 7.5.51 could allow an attacker to obtain sensitive information due to a timing attack during certain RSA operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185282
CVE ID: CVE-2024-41761 State: PUBLISHED Published: 2024-11-23T01:57:40.048Z Last Updated: 2024-11-23T13:28:21.260Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-789 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175947
CVE ID: CVE-2024-41762 State: PUBLISHED Published: 2024-12-07T13:30:48.904Z Last Updated: 2024-12-09T18:02:07.852Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-789 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175946
CVE ID: CVE-2024-41763 State: PUBLISHED Published: 2025-01-04T14:38:06.836Z Last Updated: 2025-01-06T14:26:06.253Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Lifecycle Optimization Publishing Problem Types: CWE-327 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180204
CVE ID: CVE-2024-41765 State: PUBLISHED Published: 2025-01-04T14:36:13.416Z Last Updated: 2025-01-06T16:01:44.609Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Lifecycle Optimization Publishing Problem Types: CWE-22 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180201
CVE ID: CVE-2024-41766 State: PUBLISHED Published: 2025-01-04T14:37:08.203Z Last Updated: 2025-01-06T16:01:20.543Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Engineering Lifecycle Optimization Publishing Problem Types: CWE-1333 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause a denial of service using a complex regular expression. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180203
CVE ID: CVE-2024-41767 State: PUBLISHED Published: 2025-01-04T14:27:46.134Z Last Updated: 2025-01-06T16:02:32.596Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Engineering Lifecycle Optimization Publishing Problem Types: CWE-89 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180199
CVE ID: CVE-2024-41768 State: PUBLISHED Published: 2025-01-04T14:26:32.766Z Last Updated: 2025-01-06T16:02:57.722Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: IBM Products: Engineering Lifecycle Optimization Publishing Problem Types: CWE-544 Description: IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.0.3 could allow a remote attacker to cause an unhandled SSL exception which could leave the connection in an unexpected or insecure state. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180202
CVE ID: CVE-2024-41770 State: PUBLISHED Published: 2025-03-03T15:28:57.065Z Last Updated: 2025-09-01T01:11:25.136Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Requirements Management DOORS Next Problem Types: CWE-522 Description: IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184663
CVE ID: CVE-2024-41771 State: PUBLISHED Published: 2025-03-03T15:29:14.503Z Last Updated: 2025-09-01T01:11:58.234Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Engineering Requirements Management DOORS Next Problem Types: CWE-522 Description: IBM Engineering Requirements Management DOORS Next 7.0.2, 7.0.3, and 7.1 could allow a remote attacker to download temporary files which could expose application logic or other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184663
CVE ID: CVE-2024-41773 State: PUBLISHED Published: 2024-08-20T19:26:51.148Z Last Updated: 2024-08-21T19:42:23.455Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Global Configuration Management Problem Types: CWE-708 Description: IBM Global Configuration Management 7.0.2 and 7.0.3 could allow an authenticated user to archive a global baseline due to improper access controls. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165963 - https://exchange.xforce.ibmcloud.com/vulnerabilities/350347
CVE ID: CVE-2024-41774 State: PUBLISHED Published: 2024-08-13T11:03:30.402Z Last Updated: 2024-08-24T10:51:40.563Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Common Licensing Problem Types: CWE-79 Description: IBM Common Licensing 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 350348. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165251 - https://exchange.xforc
st Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165251 - https://exchange.xforce.ibmcloud.com/vulnerabilities/350348
CVE ID: CVE-2024-41775 State: PUBLISHED Published: 2024-12-03T17:13:32.948Z Last Updated: 2024-12-03T17:55:03.866Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Controller Problem Types: CWE-327 Description: IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-41776 State: PUBLISHED Published: 2024-12-03T17:11:15.554Z Last Updated: 2024-12-03T17:55:03.583Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: IBM Products: Cognos Controller Problem Types: CWE-352 Description: IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-41777 State: PUBLISHED Published: 2024-12-03T17:10:06.403Z Last Updated: 2024-12-03T17:49:50.964Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Cognos Controller Problem Types: CWE-798 Description: IBM Cognos Controller 11.0.0 and 11.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-41778 State: PUBLISHED Published: 2025-03-01T14:22:40.930Z Last Updated: 2025-09-01T01:09:14.360Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Controller Problem Types: CWE-521 Description: IBM Controller 11.0.0 through 11.0.1 and 11.1.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7184423
CVE ID: CVE-2024-41779 State: PUBLISHED Published: 2024-11-22T12:02:49.422Z Last Updated: 2024-11-22T15:34:18.819Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Engineering Systems Design Rhapsody - Model Manager Problem Types: CWE-367 Description: IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 and 7.0.3 could allow a remote attacker to bypass security restrictions, caused by a race condition. By sending a specially crafted request, an attacker could exploit this vulnerability to remotely execute code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172535
CVE ID: CVE-2024-41780 State: PUBLISHED Published: 2025-01-03T14:38:36.851Z Last Updated: 2025-01-03T17:52:42.605Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Jazz Foundation Problem Types: CWE-359 Description: IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180119
CVE ID: CVE-2024-41781 State: PUBLISHED Published: 2024-11-22T11:55:52.350Z Last Updated: 2024-11-22T15:34:36.846Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: IBM Products: PowerVM Hypervisor Problem Types: CWE-497 Description: IBM PowerVM Platform KeyStore (IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1030.00 through FW1030.60, FW1050.00 through FW1050.20, and FW1060.00 through FW1060.10 functionality can be compromised if an attacker gains service access to the HMC. An attacker that gains service access to the HMC can locate and through a series of service procedures decrypt data contained in the Platform KeyStore. Additional Analyst Notes: - CI