Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-35858 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T16:30:45.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve
CVE ID: CVE-2023-35859 State: PUBLISHED Published: 2024-06-13T00:00:00.000Z Last Updated: 2025-03-17T18:39:42.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to inject arbitrary scripts or HTML via multiple parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve
CVE ID: CVE-2023-35860 State: PUBLISHED Published: 2024-06-13T00:00:00 Last Updated: 2024-08-02T16:30:45.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the dir parameter to listing.php or rss.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lp.constantcontactpages.com/cu/c2nSB5D/moderncampuscve
CVE ID: CVE-2023-35861 State: PUBLISHED Published: 2023-07-31T00:00:00 Last Updated: 2024-10-22T18:08:38.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.supermicro.com/en/products/motherboards - https://www.supermicro.com/en/support/security_SMTP_Jun_2023 - https://blog.freax13.de/cve/cve-2023-35861
CVE ID: CVE-2023-35862 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-11T16:54:55.045Z Vendors: n/a Products: n/a Problem Types: n/a Description: libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/obgm/libcoap/issues/1117 - https://github.com/obgm/libcoap/pull/1118 - https://github.com/obgm/libcoap/tags
CVE ID: CVE-2023-35863 State: PUBLISHED Published: 2023-07-05T00:00:00 Last Updated: 2024-11-20T21:53:20.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://ctrl-c.club/~blue/nfsdk.html - https://www.madefornet.com/products.html - https://www.michaelrowley.dev/research/posts/nfsdk/nfsdk.html
CVE ID: CVE-2023-35866 State: PUBLISHED Published: 2023-06-19T00:00:00 Last Updated: 2024-12-11T16:53:22.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker." Additional Analys
o making any changes to the database settings adds no additional protection against a local attacker." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/keepassxreboot/keepassxc/issues/9391 - https://github.com/keepassxreboot/keepassxc/issues/9339 - https://github.com/keepassxreboot/keepassxc/issues/9339#issuecomment-1598219482 - https://keepassxc.org/docs/#faq-yubikey-2fa - https://medium.com/%40cybercitizen.tech/keepassxc-vulnerability-cve-2023-35866-dc7d447c4903
CVE ID: CVE-2023-35867 State: PUBLISHED Published: 2023-12-18T12:59:48.604Z Last Updated: 2024-08-02T16:30:45.391Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Bosch Products: BVMS, BVMS Viewer, Configuration Manager, DIVAR IP 7000 R2, DIVAR IP all-in-one 5000, DIVAR IP all-in-one 7000, DIVAR IP all-in-one 7000 R3, DIVAR IP all-in-one 4000, DIVAR IP all-in-one 6000, Project Assistant, Video Security Client, BIS Video Engine, Intelligent Insights, ONVIF Camera Event Driver Tool Problem Types: CWE-703 Description: An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to caus
malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-092656-BT.html
CVE ID: CVE-2023-35870 State: PUBLISHED Published: 2023-07-11T02:40:26.084Z Last Updated: 2024-10-29T13:43:24.084Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP S/4HANA (Manage Journal Entry Template) Problem Types: CWE-732 Description: When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable. Additional Analyst Notes: - CVE Program
rd template could be deleted, hence making the resource temporarily unavailable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3341211 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-35871 State: PUBLISHED Published: 2023-07-11T02:41:03.537Z Last Updated: 2024-10-23T16:25:51.938Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: SAP_SE Products: SAP Web Dispatcher Problem Types: CWE-787 Description: The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption thro
APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3340735 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-35872 State: PUBLISHED Published: 2023-07-11T02:41:33.243Z Last Updated: 2024-11-08T18:18:30.187Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP_SE Products: SAP NetWeaver Process Integration (Message Display Tool) Problem Types: CWE-306 Description: The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On su
configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3343564 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-35873 State: PUBLISHED Published: 2023-07-11T02:42:19.464Z Last Updated: 2024-11-08T17:42:42.820Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: SAP_SE Products: SAP NetWeaver Process Integration (Runtime Workbench) Problem Types: CWE-306 Description: The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On succes
iguration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3343547 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-35874 State: PUBLISHED Published: 2023-07-11T02:47:11.869Z Last Updated: 2024-10-23T16:26:07.026Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: SAP_SE Products: SAP NetWeaver AS ABAP and ABAP Platform Problem Types: CWE-306 Description: SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious
erforms improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://me.sap.com/notes/3318850 - https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html
CVE ID: CVE-2023-35875 State: PUBLISHED Published: 2024-12-13T14:23:40.992Z Last Updated: 2024-12-13T18:37:19.906Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Jegstudio Products: Gutenverse Problem Types: CWE-862 Description: Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/gutenverse/vulnerability/wordpress-gutenverse-gutenberg-blocks-page-builder-for-site-editor-plugin-1-8-5-broken-access-control-vulnerab
erability/wordpress-gutenverse-gutenberg-blocks-page-builder-for-site-editor-plugin-1-8-5-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2023-35876 State: PUBLISHED Published: 2023-12-20T14:42:18.072Z Last Updated: 2024-08-02T16:30:45.385Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: WooCommerce Products: WooCommerce Square Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-square/wordpress-woocommerce-square-plugin-3-8-1-insecure-direct-object-references-idor-vulnerability?_s_id=cve
CVE ID: CVE-2023-35877 State: PUBLISHED Published: 2023-11-13T17:06:24.296Z Last Updated: 2024-08-28T15:09:32.810Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Vadym K. Products: Extra User Details Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/extra-user-details/wordpress-extra-user-details-plugin-0-5-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35878 State: PUBLISHED Published: 2023-06-20T07:57:08.943Z Last Updated: 2024-10-10T18:14:31.123Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Vadym K. Products: Extra User Details Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/extra-user-details/wordpress-extra-user-details-plugin-0-5-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35879 State: PUBLISHED Published: 2023-10-31T14:20:22.918Z Last Updated: 2024-09-05T17:49:06.975Z Vendors: WooCommerce Products: Product Vendors Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-product-vendors/wordpress-woocommerce-product-vendors-plugin-2-1-78-shop-manager-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2023-35880 State: PUBLISHED Published: 2023-07-17T13:40:19.627Z Last Updated: 2024-09-30T14:39:44.357Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WooCommerce Products: WooCommerce Brands Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woocommerce-brands/wordpress-woocommerce-brands-plugin-1-6-49-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2023-35881 State: PUBLISHED Published: 2024-05-17T06:46:48.341Z Last Updated: 2024-08-02T16:37:39.936Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: WooCommerce Products: WooCommerce One Page Checkout Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-one-page-checkout/wordpres
VE Program Container: References: - https://patchstack.com/database/vulnerability/woocommerce-one-page-checkout/wordpress-woocommerce-one-page-checkout-plugin-2-3-0-local-file-inclusion-vulnerability?_s_id=cve
CVE ID: CVE-2023-35882 State: PUBLISHED Published: 2023-06-20T07:53:58.274Z Last Updated: 2024-10-10T18:33:31.621Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: Team Heateor Products: Super Socializer Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/super-socializer/wordpress-super-socializer-plugin-7-13-52-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35883 State: PUBLISHED Published: 2023-12-19T20:11:11.659Z Last Updated: 2024-08-02T16:37:39.908Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) Vendors: Magazine3 Products: Core Web Vitals & PageSpeed Booster Problem Types: CWE-601 Description: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/core-web-vitals-pagespeed-booster/wordpress-core-web-vitals-pagespeed-booster-plugin-1-0-12-open-redirec
e/vulnerability/core-web-vitals-pagespeed-booster/wordpress-core-web-vitals-pagespeed-booster-plugin-1-0-12-open-redirection-vulnerability?_s_id=cve
CVE ID: CVE-2023-35884 State: PUBLISHED Published: 2023-06-20T06:50:34.373Z Last Updated: 2024-10-10T18:35:32.282Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: EventPrime Products: EventPrime Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/eventprime-event-calendar-management/wordpress-eventprime-plugin-3-0-5-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2023-35885 State: PUBLISHED Published: 2023-06-20T00:00:00 Last Updated: 2024-12-09T19:01:40.906Z Vendors: n/a Products: n/a Problem Types: n/a Description: CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cloudpanel.io/docs/v2/changelog/ - https://www.datack.my/fallingskies-cloudpanel-0-day/ - https://github.com/datackmy/FallingSkies-CVE-2023-35885
CVE ID: CVE-2023-35887 State: PUBLISHED Published: 2023-07-10T09:28:54.987Z Last Updated: 2024-10-07T19:40:46.159Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: Apache Software Foundation Products: Apache MINA SSHD Problem Types: CWE-22 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache
ted tree via paths including parent navigation ("..") beyond the root, or involving symlinks. This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/b9qgtqvhnvgfpn0w1gz918p21p53tqk2
CVE ID: CVE-2023-35888 State: PUBLISHED Published: 2024-03-20T13:25:12.617Z Last Updated: 2024-08-02T16:37:39.908Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Governance Problem Types: CWE-311 Description: IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 258375. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/suppo
375. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7144228 - https://exchange.xforce.ibmcloud.com/vulnerabilities/258375
CVE ID: CVE-2023-35890 State: PUBLISHED Published: 2023-07-07T02:13:23.147Z Last Updated: 2024-10-24T13:09:32.728Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-327 Description: IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file. IBM X-Force ID: 258637. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7007857 - https://https://www.ibm.com/support/pages/node/7007857
CVE ID: CVE-2023-35892 State: PUBLISHED Published: 2023-09-04T23:45:38.833Z Last Updated: 2024-09-26T18:29:59.332Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: Financial Transaction Manager for SWIFT Services Problem Types: CWE-611 Description: IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 258786. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/page
ditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7030359 - https://exchange.xforce.ibmcloud.com/vulnerabilities/258786
CVE ID: CVE-2023-35893 State: PUBLISHED Published: 2023-08-16T21:53:30.913Z Last Updated: 2024-10-08T16:04:20.799Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Security Guardium Problem Types: CWE-78 Description: IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7027853 - https://exchange.xforce.ibmcloud.com/vulnerabilities/258824
CVE ID: CVE-2023-35894 State: PUBLISHED Published: 2025-03-07T16:47:52.841Z Last Updated: 2025-08-17T00:08:13.891Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Control Center Problem Types: CWE-644 Description: IBM Control Center 6.2.1 through 6.3.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7185101
CVE ID: CVE-2023-35895 State: PUBLISHED Published: 2023-12-20T14:18:56.529Z Last Updated: 2024-08-02T16:37:40.032Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Informix JDBC Problem Types: CWE-78 Description: IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 259116. Additional Analyst Notes: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7099762 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259116