Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-49770 State: PUBLISHED Published: 2024-11-01T16:16:29.482Z Last Updated: 2024-11-01T17:35:10.386Z Vendors: oakserver Products: oak Problem Types: CWE-35, CWE-22 Description: `oak` is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. By default `oak` does not allow transferring of hidden files with `Context.send` API. However, prior to version 17.1.3, this can be bypassed by encoding `/` as its URL encoded form `%2F`. For an attacker this has potential to read sensitive user data or to gain access to server secrets. Version 17.1.3 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References
access to server secrets. Version 17.1.3 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/oakserver/oak/security/advisories/GHSA-qm92-93fv-vh7m - https://github.com/oakserver/oak/commit/4b2f27efd5cba5a45b2c3982e610da3af0869209 - https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L117-L125 - https://github.com/oakserver/oak/blob/3896fe568b25ac0b4c5afbf822ff8344c3d1712a/send.ts#L182C10-L182C25
CVE ID: CVE-2024-49771 State: PUBLISHED Published: 2024-10-28T16:57:43.271Z Last Updated: 2024-10-29T13:37:18.103Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: joniles Products: mpxj Problem Types: CWE-22 Description: MPXJ is an open source library to read and write project plans from a variety of file formats and databases. The patch for the historical vulnerability CVE-2020-35460 in MPXJ is incomplete as there is still a possibility that a malicious path could be constructed which would not be picked up by the original fix and allow files to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1. Additional Analyst Notes: - CIS
les to be written to arbitrary locations. The issue is addressed in MPXJ version 13.5.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6 - https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0
CVE ID: CVE-2024-49772 State: PUBLISHED Published: 2024-11-05T18:31:20.615Z Last Updated: 2024-11-05T19:00:51.220Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been addressed in releases 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Anal
s 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-4xj8-hr85-hm3m
CVE ID: CVE-2024-49773 State: PUBLISHED Published: 2024-11-05T18:35:11.102Z Last Updated: 2024-11-05T18:59:49.367Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-89 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Poor input validation in export allows authenticated user do a SQL injection attack. User-controlled input is used to build SQL query. `current_post` parameter in `export` entry point can be abused to perform blind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable infor
lind SQL injection via generateSearchWhere(). Allows for Information disclosure, including personally identifiable information. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-5hr4-r43c-6qf7
CVE ID: CVE-2024-49774 State: PUBLISHED Published: 2024-11-05T18:37:05.422Z Last Updated: 2024-11-05T18:59:06.730Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: salesagility Products: SuiteCRM Problem Types: CWE-20 Description: SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been address
d check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/salesagility/SuiteCRM/security/advisories/GHSA-9v56-vhp4-x227
CVE ID: CVE-2024-49775 State: PUBLISHED Published: 2024-12-16T15:06:04.714Z Last Updated: 2025-03-12T16:34:51.664Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, Opcenter RDL, SIMATIC PCS neo V4.0, SIMATIC PCS neo V4.1, SIMATIC PCS neo V5.0, SINEC NMS, Totally Integrated Automation Portal (TIA Portal) V16, Totally Integrated Automation Portal (TIA Portal) V17, Totally Integrated Automation Portal (TIA Portal) V18, Totally Integrated Automation Portal (TIA Portal) V19 Problem Types: CWE-122 Description: A vulnerability has been identified in Opcenter Exe
tomation Portal (TIA Portal) V19 Problem Types: CWE-122 Description: A vulnerability has been identified in Opcenter Execution Foundation (All versions), Opcenter Intelligence (All versions), Opcenter Quality (All versions), Opcenter RDL (All versions), SIMATIC PCS neo V4.0 (All versions), SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1), SINEC NMS (All versions if operated in conjunction with UMC < V2.15), Totally Integrated Automation Portal (TIA Portal) V16 (All versions), Totally Integrated Automation Portal (TIA Portal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Auto
ortal) V17 (All versions), Totally Integrated Automation Portal (TIA Portal) V18 (All versions), Totally Integrated Automation Portal (TIA Portal) V19 (All versions). Affected products contain a heap-based buffer overflow vulnerability in the integrated UMC component. This could allow an unauthenticated remote attacker to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/html/ssa-928984.html
CVE ID: CVE-2024-49776 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:15:28.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: A negative-size-param in tsMuxer version nightly-2024-04-05-01-53-02 allows attackers to cause Denial of Service (DoS) via a crafted TS video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/862
CVE ID: CVE-2024-49777 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:14:19.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in tsMuxer version nightly-2024-03-14-01-51-12 allows attackers to cause Denial of Service (DoS), Information Disclosure and Code Execution via a crafted MKV video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/842
CVE ID: CVE-2024-49778 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T18:09:36.865Z Vendors: n/a Products: n/a Problem Types: n/a Description: A heap-based buffer overflow in tsMuxer version nightly-2024-05-12-02-01-18 allows attackers to cause Denial of Service (DoS) and Code Execution via a crafted MOV video file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/justdan96/tsMuxer/issues/879
CVE ID: CVE-2024-49779 State: PUBLISHED Published: 2025-02-20T12:06:44.634Z Last Updated: 2025-08-15T14:50:00.706Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-352 Description: IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to bypass security restrictions, caused by improper validation and management of authentication cookies. By modifying the CSRF token and Session Id cookie parameters using the cookies of another user, a remote attacker could exploit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application. Addit
oit this vulnerability to bypass security restrictions and gain unauthorized access to the vulnerable application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49780 State: PUBLISHED Published: 2025-02-20T03:49:09.533Z Last Updated: 2025-08-15T14:48:52.745Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-22 Description: IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages could allow a remote attacker to traverse directories on the system. An attacker with privileges to perform Import Configuration could send a specially crafted http request containing "dot dot" sequences (/../) in the file name parameter used in Import Configuration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files.
ration to write files to arbitrary locations outside of the specified directory and possibly overwrite arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49781 State: PUBLISHED Published: 2025-02-20T12:04:56.750Z Last Updated: 2025-08-15T14:47:19.924Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-611 Description: IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49782 State: PUBLISHED Published: 2025-02-20T03:46:38.398Z Last Updated: 2025-08-15T14:44:56.445Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-297 Description: IBM OpenPages with Watson 8.3 and 9.0 could allow a remote attacker to spoof mail server identity when using SSL/TLS security. An attacker could exploit this vulnerability to gain access to sensitive information disclosed through email notifications generated by OpenPages or disrupt notification delivery. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183541
CVE ID: CVE-2024-49783 State: PUBLISHED Published: 2025-07-08T18:36:50.595Z Last Updated: 2025-08-24T11:21:43.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-329 Description: IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data, they could exploit this vulnerability to use additional cryptographic methods to possibly extract the encrypted data. Additional Analyst Notes: - CISA ADP Vulnrichment: Refe
al cryptographic methods to possibly extract the encrypted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239145
CVE ID: CVE-2024-49784 State: PUBLISHED Published: 2025-07-08T18:35:23.609Z Last Updated: 2025-08-24T11:21:07.665Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: OpenPages with Watson Problem Types: CWE-327 Description: IBM OpenPages with Watson 8.3 and 9.0 could provide weaker than expected security in storage of encrypted data with AES encryption and CBC mode. If an authenticated remote attacker with access to the database or a local attacker with access to server files could extract the encrypted data values they could exploit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data. Additional An
loit this weaker algorithm to use additional cryptographic methods to possibly extract the encrypted data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7239145
CVE ID: CVE-2024-49785 State: PUBLISHED Published: 2025-01-12T01:10:43.851Z Last Updated: 2025-01-13T15:16:25.499Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: watsonx.ai, watsonx.ai on Cloud Pak for Data Problem Types: CWE-79 Description: IBM watsonx.ai 1.1 through 2.0.3 and IBM watsonx.ai on Cloud Pak for Data 4.8 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180723
CVE ID: CVE-2024-49790 State: PUBLISHED Published: 2025-08-28T14:09:59.110Z Last Updated: 2025-08-28T14:46:56.813Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: Watson Studio on Cloud Pak for Data Problem Types: CWE-79 Description: IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7243389
CVE ID: CVE-2024-49791 State: PUBLISHED Published: 2025-02-05T23:26:50.609Z Last Updated: 2025-02-22T22:03:19.201Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-79 Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49792 State: PUBLISHED Published: 2025-02-05T23:33:12.187Z Last Updated: 2025-02-22T22:04:01.125Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-79 Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49793 State: PUBLISHED Published: 2025-02-05T23:35:59.093Z Last Updated: 2025-02-22T22:04:26.181Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-79 Description: IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49794 State: PUBLISHED Published: 2025-02-05T23:40:00.980Z Last Updated: 2025-02-22T22:04:57.458Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-352 Description: IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49795 State: PUBLISHED Published: 2025-02-05T23:41:38.862Z Last Updated: 2025-02-22T22:05:21.406Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-352 Description: IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49796 State: PUBLISHED Published: 2025-02-05T23:46:03.030Z Last Updated: 2025-02-22T22:05:48.024Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-1021 Description: IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49797 State: PUBLISHED Published: 2025-02-05T23:48:23.728Z Last Updated: 2025-02-22T22:06:18.823Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-327 Description: IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49798 State: PUBLISHED Published: 2025-02-05T23:50:19.372Z Last Updated: 2025-02-22T22:06:46.630Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-209 Description: IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49800 State: PUBLISHED Published: 2025-02-05T23:55:30.158Z Last Updated: 2025-02-22T22:07:39.957Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: ApplinX Problem Types: CWE-316 Description: IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182522
CVE ID: CVE-2024-49803 State: PUBLISHED Published: 2024-11-29T16:50:31.964Z Last Updated: 2024-11-29T17:09:49.402Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Problem Types: CWE-78 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177447
CVE ID: CVE-2024-49804 State: PUBLISHED Published: 2024-11-29T16:55:32.323Z Last Updated: 2024-11-29T17:09:49.542Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: Security Verify Access Problem Types: CWE-250 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177447
CVE ID: CVE-2024-49805 State: PUBLISHED Published: 2024-11-29T16:52:15.174Z Last Updated: 2024-11-29T17:09:49.677Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: IBM Products: Security Verify Access Problem Types: CWE-798 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177447
CVE ID: CVE-2024-49806 State: PUBLISHED Published: 2024-11-29T16:53:45.208Z Last Updated: 2024-11-29T17:09:49.806Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: IBM Products: Security Verify Access Problem Types: CWE-798 Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177447
CVE ID: CVE-2024-49807 State: PUBLISHED Published: 2025-01-31T15:25:27.961Z Last Updated: 2025-01-31T15:50:22.706Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-79 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ib
als disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182011
CVE ID: CVE-2024-49808 State: PUBLISHED Published: 2025-04-18T11:03:58.511Z Last Updated: 2025-09-01T00:41:53.758Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: IBM Products: Sterling Connect:Direct Web Services Problem Types: CWE-863 Description: IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 could allow an authenticated user to spoof the identity of another user due to improper authorization which could allow the user to bypass access restrictions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7231180