Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-50924 State: PUBLISHED Published: 2023-12-22T20:37:47.224Z Last Updated: 2024-11-27T15:33:49.900Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: engelsystem Products: engelsystem Problem Types: CWE-79 Description: Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript
tion of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/engelsystem/engelsystem/security/advisories/GHSA-p5ch-rrpm-wvhm - https://github.com/engelsystem/engelsystem/commit/efda1ffc1ce59f02a7d237d9087adea26e73ec5f
CVE ID: CVE-2023-50926 State: PUBLISHED Published: 2024-02-14T19:28:11.556Z Last Updated: 2024-08-02T22:23:44.103Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-125 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An out-of-bounds read can be caused by an incoming DIO message when using the RPL-Lite implementation in the Contiki-NG operating system. More specifically, the prefix information of the DIO message contains a field that specifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker ca
pecifies the length of an IPv6 address prefix. The value of this field is not validated, which means that an attacker can set a value that is longer than the maximum prefix length. Subsequently, a memcmp function call that compares different prefixes can be called with a length argument that surpasses the boundary of the array allocated for the prefix, causing an out-of-bounds read. The problem has been patched in the "develop" branch of Contiki-NG, and is expected to be included in the next release. Users are advised to update as soon as they are able to or to manually apply the changes in Contiki-NG pull request #2721. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Contai
ly the changes in Contiki-NG pull request #2721. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-jp4p-fq85-jch2 - https://github.com/contiki-ng/contiki-ng/pull/2721
CVE ID: CVE-2023-50927 State: PUBLISHED Published: 2024-02-14T19:22:05.243Z Last Updated: 2025-04-24T15:15:35.777Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-125 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. An attacker can trigger out-of-bounds reads in the RPL-Lite implementation of the RPL protocol in the Contiki-NG operating system. This vulnerability is caused by insufficient control of the lengths for DIO and DAO messages, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are adv
s, in particular when they contain RPL sub-option headers. The problem has been patched in Contiki-NG 4.9. Users are advised to upgrade. Users unable to upgrade should manually apply the code changes in PR #2484. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-9423-rgj4-wjfw - https://github.com/contiki-ng/contiki-ng/pull/2484
CVE ID: CVE-2023-50928 State: PUBLISHED Published: 2023-12-22T21:00:49.814Z Last Updated: 2024-08-02T22:23:43.827Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: awslabs Products: sandbox-accounts-for-events Problem Types: CWE-284 Description: "Sandbox Accounts for Events" provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accoun
nd self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-cg8w-7q5v-g32r - https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79
CVE ID: CVE-2023-50930 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-05-14T19:23:28.910Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in savignano S/Notify before 4.0.2 for Jira. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on th
administrator is logged on to Jira, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE ID: CVE-2023-50931 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-04-17T18:00:42.044Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify
e an administrator is logged on to Bitbucket, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE ID: CVE-2023-50932 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-13T19:02:33.945Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:U/UI:R) Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. While an administrative user is logged on, the configuration settings of S/Notify can be modified via a CSRF attack. The injection could be initiated by the administrator clicking a malicious link in an email or by visiting a malicious website. If executed while an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Noti
le an administrator is logged on to Confluence, an attacker could exploit this to modify the configuration of the S/Notify app on that host. This can, in particular, lead to email notifications being no longer encrypted when they should be. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.savignano.net/snotify-email-encryption/sa-2023-11-28
CVE ID: CVE-2023-50933 State: PUBLISHED Published: 2024-02-02T00:05:32.248Z Last Updated: 2025-06-03T18:57:24.554Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: PowerSC Problem Types: 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 275113. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/p
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275113
CVE ID: CVE-2023-50934 State: PUBLISHED Published: 2024-02-02T01:08:46.298Z Last Updated: 2024-08-02T22:23:44.110Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-308 Description: IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. IBM X-Force ID: 275114. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275114
CVE ID: CVE-2023-50935 State: PUBLISHED Published: 2024-02-02T01:12:54.221Z Last Updated: 2024-08-02T22:23:44.072Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-425 Description: IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. IBM X-Force ID: 275115. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275115
CVE ID: CVE-2023-50936 State: PUBLISHED Published: 2024-02-02T01:03:34.263Z Last Updated: 2024-08-02T22:23:44.113Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: PowerSC Problem Types: CWE-613 Description: IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275116
CVE ID: CVE-2023-50937 State: PUBLISHED Published: 2024-02-02T00:10:06.636Z Last Updated: 2024-08-02T22:23:44.033Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-327 Description: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275117
CVE ID: CVE-2023-50938 State: PUBLISHED Published: 2024-02-02T01:14:20.340Z Last Updated: 2024-08-02T22:23:44.093Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-451 Description: IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 275128. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/
. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275128
CVE ID: CVE-2023-50939 State: PUBLISHED Published: 2024-02-01T23:53:06.761Z Last Updated: 2024-08-02T22:23:44.115Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-327 Description: IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275129. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275129
CVE ID: CVE-2023-50940 State: PUBLISHED Published: 2024-02-02T01:05:18.602Z Last Updated: 2024-08-02T22:23:44.049Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: IBM Products: PowerSC Problem Types: CWE-942 Description: IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabili
ntainer: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275130
CVE ID: CVE-2023-50941 State: PUBLISHED Published: 2024-02-02T01:11:23.968Z Last Updated: 2024-08-02T22:23:44.166Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: PowerSC Problem Types: CWE-384 Description: IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation. IBM X-Force ID: 275131. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7113759 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275131
CVE ID: CVE-2023-50943 State: PUBLISHED Published: 2024-01-24T12:57:07.287Z Last Updated: 2025-05-30T14:16:49.346Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-502 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
e to version 2.8.1 or later, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/36255 - https://lists.apache.org/thread/fx278v0twqzxkcts70tc04cp3f8p56pn - http://www.openwall.com/lists/oss-security/2024/01/24/4
CVE ID: CVE-2023-50944 State: PUBLISHED Published: 2024-01-24T12:58:18.873Z Last Updated: 2025-06-11T17:02:59.150Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-862 Description: Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/36257 - https://lists.apache.o
Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/36257 - https://lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h - http://www.openwall.com/lists/oss-security/2024/01/24/5
CVE ID: CVE-2023-50945 State: PUBLISHED Published: 2025-01-26T15:43:09.312Z Last Updated: 2025-01-27T14:52:26.925Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Common Licensing Problem Types: CWE-256 Description: IBM Common Licensing 9.0 stores user credentials in plain clear text which can be read by a local user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7161947
CVE ID: CVE-2023-50946 State: PUBLISHED Published: 2025-01-26T15:44:22.056Z Last Updated: 2025-01-27T14:52:16.993Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Common Licensing Problem Types: CWE-863 Description: IBM Common Licensing 9.0 could allow an authenticated user to modify a configuration file that they should not have access to due to a broken authorization mechanism. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7161947
CVE ID: CVE-2023-50947 State: PUBLISHED Published: 2024-02-04T00:11:02.465Z Last Updated: 2024-08-22T17:41:47.983Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Business Automation Workflow Problem Types: CWE-79 Description: IBM Business Automation Workflow 22.0.2, 23.0.1, and 23.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 275665. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.co
ID: 275665. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7114419 - https://www.ibm.com/support/pages/node/7114430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275665
CVE ID: CVE-2023-50948 State: PUBLISHED Published: 2024-01-08T01:43:08.302Z Last Updated: 2025-06-03T14:38:46.312Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Fusion HCI Problem Types: CWE-259 Description: IBM Storage Fusion HCI 2.1.0 through 2.6.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 275671. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105509 - https://exchange.xforce.i
ainer: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7105509 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275671
CVE ID: CVE-2023-50949 State: PUBLISHED Published: 2024-04-11T16:54:41.741Z Last Updated: 2024-08-02T22:23:44.080Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-295 Description: IBM QRadar SIEM 7.5 could allow an unauthorized user to perform unauthorized actions due to improper certificate validation. IBM X-Force ID: 275706. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147933 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275706
CVE ID: CVE-2023-50950 State: PUBLISHED Published: 2024-01-17T17:08:30.053Z Last Updated: 2024-08-02T22:23:44.097Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: QRadar SIEM Problem Types: CWE-200 Description: IBM QRadar SIEM 7.5 could disclose sensitive email information in responses from offense rules. IBM X-Force ID: 275709. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7108657 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275709
CVE ID: CVE-2023-50951 State: PUBLISHED Published: 2024-02-17T16:00:51.779Z Last Updated: 2024-08-02T22:23:44.177Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-532 Description: IBM QRadar Suite 1.10.12.0 through 1.10.17.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 in some circumstances will log some sensitive information about invalid authorization attempts. IBM X-Force ID: 275747. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7118604 - https://exchange.xforce.ibmcloud.com/vulnerabil
ontainer: References: - https://www.ibm.com/support/pages/node/7118604 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275747
CVE ID: CVE-2023-50952 State: PUBLISHED Published: 2024-06-30T18:06:11.581Z Last Updated: 2024-08-02T22:23:44.045Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-918 Description: IBM InfoSphere Information Server 11.7 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 275774. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158437 - https:
- CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158437 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275774
CVE ID: CVE-2023-50953 State: PUBLISHED Published: 2024-06-30T18:08:20.068Z Last Updated: 2024-08-02T22:23:44.035Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-209 Description: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system. IBM X-Force ID: 275775. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7159057 - https://exchange.xforce.ibmcloud.com
E Program Container: References: - https://www.ibm.com/support/pages/node/7159057 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275775
CVE ID: CVE-2023-50954 State: PUBLISHED Published: 2024-06-30T16:40:59.263Z Last Updated: 2024-08-02T22:23:44.104Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: InfoSphere Information Server Problem Types: CWE-598 Description: IBM InfoSphere Information Server 11.7 returns sensitive information in URL information that could be used in further attacks against the system. IBM X-Force ID: 275776. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158597 - https://exchange.xforce.ibmcloud.com/vulnerabilities/275776