Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-34985 State: PUBLISHED Published: 2023-10-10T16:50:43.265Z Last Updated: 2024-09-19T18:58:37.205Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-141
CVE ID: CVE-2023-34986 State: PUBLISHED Published: 2023-10-10T16:50:47.229Z Last Updated: 2024-09-19T19:04:39.097Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-141
CVE ID: CVE-2023-34987 State: PUBLISHED Published: 2023-10-10T16:50:51.172Z Last Updated: 2024-09-19T19:06:45.440Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-141
CVE ID: CVE-2023-34988 State: PUBLISHED Published: 2023-10-10T16:50:39.390Z Last Updated: 2024-09-19T18:50:46.505Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-141
CVE ID: CVE-2023-34989 State: PUBLISHED Published: 2023-10-10T16:50:55.029Z Last Updated: 2024-09-19T19:09:33.847Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-141
CVE ID: CVE-2023-34990 State: PUBLISHED Published: 2024-12-18T12:44:38.664Z Last Updated: 2024-12-20T04:55:50.572Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-23 Description: A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specially crafted web requests. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-144
CVE ID: CVE-2023-34991 State: PUBLISHED Published: 2023-11-14T18:07:32.529Z Last Updated: 2024-10-22T20:51:57.761Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-89 Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.0 through 8.4.2 and 8.3.0 through 8.3.2 and 8.2.2 allows attacker to execute unauthorized code or commands via a crafted http request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-142
CVE ID: CVE-2023-34992 State: PUBLISHED Published: 2023-10-10T16:50:21.319Z Last Updated: 2024-08-02T16:17:04.307Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiSIEM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 7.0.0 and 6.7.0 through 6.7.5 and 6.6.0 through 6.6.3 and 6.5.0 through 6.5.1 and 6.4.0 through 6.4.2 allows attacker to execute unauthorized code or commands via crafted API requests. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/ps
sts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://fortiguard.com/psirt/FG-IR-23-130
CVE ID: CVE-2023-34993 State: PUBLISHED Published: 2023-10-10T16:51:08.092Z Last Updated: 2024-09-19T19:24:33.101Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:X/RC:X) Vendors: Fortinet Products: FortiWLM Problem Types: CWE-78 Description: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-23-140
CVE ID: CVE-2023-34994 State: PUBLISHED Published: 2023-09-05T16:15:03.744Z Last Updated: 2025-02-13T16:55:42.331Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-770 Description: An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to creation of an arbitrary directory. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1773 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1773
CVE ID: CVE-2023-34995 State: PUBLISHED Published: 2023-07-06T23:05:21.253Z Last Updated: 2024-11-13T21:22:35.694Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PiiGAB Products: M-Bus SoftwarePack Problem Types: CWE-521 Description: There are no requirements for setting a complex password for PiiGAB M-Bus, which could contribute to a successful brute force attack if the password is inline with recommended password guidelines. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-187-01
CVE ID: CVE-2023-34997 State: PUBLISHED Published: 2023-11-14T19:04:40.233Z Last Updated: 2024-08-30T17:39:08.073Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel Server Configuration Utility software Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0
iner: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00925.html
CVE ID: CVE-2023-34998 State: PUBLISHED Published: 2023-09-05T16:15:05.068Z Last Updated: 2025-02-13T16:55:42.910Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Open Automation Software Products: OAS Platform Problem Types: CWE-319 Description: An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072. A specially crafted series of network requests can lead to arbitrary authentication. An attacker can sniff network traffic to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_r
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1770 - https://www.talosintelligence.com/vulnerability_reports/TALOS-2023-1770
CVE ID: CVE-2023-34999 State: PUBLISHED Published: 2023-09-18T10:16:14.009Z Last Updated: 2024-09-25T15:35:46.960Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: RTS Products: VLink Virtual Matrix Software Problem Types: CWE-94 Description: A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-893251-BT.html
CVE ID: CVE-2023-35001 State: PUBLISHED Published: 2023-07-05T18:35:17.785Z Last Updated: 2025-02-13T16:55:43.429Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Linux Kernel Problem Types: CWE-787 Description: Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byteorder poorly handled vm register contents when CAP_NET_ADMIN is in any user or network namespace Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/netfilter-devel/20230705121515.747251-1-cascardo@canonical.com/T/ - https://www.openwall.com/lists/oss-security/2023/07/05/3 - http://www.openwall.com/lists/oss-security/2023/07/05/3 -
/ - https://www.openwall.com/lists/oss-security/2023/07/05/3 - http://www.openwall.com/lists/oss-security/2023/07/05/3 - https://www.debian.org/security/2023/dsa-5453 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UPHI46ROSSLVAV4R5LJWJYU747JGOS6D/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RGZC5XOANA75OJ4XARBBXYSLDKUIJI5E/ - http://packetstormsecurity.com/files/173757/Kernel-Live-Patch-Security-Notice-LSN-0096-1.html - https://lists.debian.org/debian-lts-announce/2023/08/msg00001.html - https://security.netapp.com/advisory/ntap-20230824-0007/ - http://packetstormsecurity.com/files/174577/K
msg00001.html - https://security.netapp.com/advisory/ntap-20230824-0007/ - http://packetstormsecurity.com/files/174577/Kernel-Live-Patch-Security-Notice-LSN-0097-1.html - https://lists.debian.org/debian-lts-announce/2024/01/msg00004.html
CVE ID: CVE-2023-35002 State: PUBLISHED Published: 2023-09-25T15:22:34.091Z Last Updated: 2025-11-04T19:16:51.860Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Accusoft Products: ImageGear Problem Types: CWE-119 Description: A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1760
CVE ID: CVE-2023-35003 State: PUBLISHED Published: 2024-02-14T13:38:03.297Z Last Updated: 2024-08-14T20:24:29.225Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) VROC software Problem Types: escalation of privilege, CWE-249 Description: Path transversal in some Intel(R) VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00953.html
CVE ID: CVE-2023-35004 State: PUBLISHED Published: 2024-01-08T14:47:45.725Z Last Updated: 2025-11-04T18:14:43.911Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GTKWave Products: GTKWave Problem Types: CWE-190 Description: An integer overflow vulnerability exists in the VZT longest_len value allocation functionality of GTKWave 3.3.115. A specially crafted .vzt file can lead to arbitrary code execution. A victim would need to open a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1816 - https://lists.debian.org
lnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2023-1816 - https://lists.debian.org/debian-lts-announce/2024/04/msg00007.html
CVE ID: CVE-2023-35005 State: PUBLISHED Published: 2023-06-19T08:15:18.029Z Last Updated: 2024-10-09T14:11:44.152Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-200 Description: In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later. Additional Analyst Notes: - CVE Program Containe
efore 2.6.2. Users are recommended to update to version 2.6.2 or later. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/31788 - https://github.com/apache/airflow/pull/31820 - https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
CVE ID: CVE-2023-35006 State: PUBLISHED Published: 2024-07-10T15:23:14.151Z Last Updated: 2025-09-15T20:01:00.851Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Security QRadar EDR Problem Types: CWE-80 Description: IBM Security QRadar EDR 3.12 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7159770
CVE ID: CVE-2023-35009 State: PUBLISHED Published: 2023-08-16T22:44:27.127Z Last Updated: 2025-02-13T16:55:44.503Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-209 Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could allow a remote attacker to obtain system information without authentication which could be used in reconnaissance to gather information that could be used for future attacks. IBM X-Force ID: 257703. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7026692 - https://exchange.xforce.ibmcloud.com/vulnera
ulnrichment: References: - https://www.ibm.com/support/pages/node/7026692 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257703 - https://security.netapp.com/advisory/ntap-20230831-0014/ - https://security.netapp.com/advisory/ntap-20240621-0005/
CVE ID: CVE-2023-35011 State: PUBLISHED Published: 2023-08-16T22:46:33.755Z Last Updated: 2025-02-13T16:55:45.100Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-918 Description: IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 257705. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7026692 - https://ex
VE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7026692 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257705 - https://security.netapp.com/advisory/ntap-20230921-0005/ - https://security.netapp.com/advisory/ntap-20240621-0005/
CVE ID: CVE-2023-35012 State: PUBLISHED Published: 2023-07-17T00:01:20.010Z Last Updated: 2024-11-05T15:08:39.983Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-121 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system. IBM X-Force ID: 257763. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.c
ID: 257763. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7010747 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257763 - https://security.netapp.com/advisory/ntap-20230818-0013/
CVE ID: CVE-2023-35013 State: PUBLISHED Published: 2023-10-15T23:43:26.543Z Last Updated: 2024-09-16T19:17:48.777Z Severity: LOW (CVSS 2.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Security Verify Governance Problem Types: CWE-540 Description: IBM Security Verify Governance 10.0, Identity Manager could allow a local privileged user to obtain sensitive information from source code. IBM X-Force ID: 257769. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7050358 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257769
CVE ID: CVE-2023-35016 State: PUBLISHED Published: 2023-07-31T00:29:37.729Z Last Updated: 2024-10-11T19:11:23.390Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Governance, Identity Manager Problem Types: CWE-22 Description: IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257772. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7014397 - https://exchange.xforce.ibmcloud.com/vulnerabilities/25772
CVE ID: CVE-2023-35017 State: PUBLISHED Published: 2025-01-29T00:00:14.545Z Last Updated: 2025-01-29T14:12:47.145Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Governance Problem Types: CWE-319 Description: IBM Security Verify Governance 10.0.2 Identity Manager can transmit user credentials in clear text that could be obtained by an attacker using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172423
CVE ID: CVE-2023-35018 State: PUBLISHED Published: 2023-10-15T23:46:49.009Z Last Updated: 2024-09-16T19:15:18.958Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security Verify Governance Problem Types: CWE-434 Description: IBM Security Verify Governance 10.0 could allow a privileged use to upload arbitrary files due to improper file validation. IBM X-Force ID: 259382. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7050358 - https://exchange.xforce.ibmcloud.com/vulnerabilities/259382
CVE ID: CVE-2023-35019 State: PUBLISHED Published: 2023-07-31T00:27:01.113Z Last Updated: 2024-10-18T20:24:59.638Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Governance, Identity Manager Problem Types: CWE-78 Description: IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 257873. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7014397 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257873
CVE ID: CVE-2023-35020 State: PUBLISHED Published: 2024-01-19T01:05:47.570Z Last Updated: 2024-10-21T11:36:55.718Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: Sterling Control Center Problem Types: CWE-22 Description: IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 257874. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7107788 - https://exchange.xforce.ibmcloud
- CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7107788 - https://exchange.xforce.ibmcloud.com/vulnerabilities/257874
CVE ID: CVE-2023-35022 State: PUBLISHED Published: 2024-06-30T16:10:56.752Z Last Updated: 2025-01-09T21:37:22.665Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-285 Description: IBM InfoSphere Information Server 11.7 could allow a local user to update projects that they do not have the authorization to access. IBM X-Force ID: 258254. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158447 - https://exchange.xforce.ibmcloud.com/vulnerabilities/258254
CVE ID: CVE-2023-35024 State: PUBLISHED Published: 2023-10-14T15:07:18.696Z Last Updated: 2024-09-16T20:09:53.343Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Cloud Pak for Business Automation Problem Types: CWE-79 Description: IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 258349. Additional