Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
/en/docs/quic.html . NOTE: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000138444 - http://www.openwall.com/lists/oss-security/2024/05/30/4
CVE ID: CVE-2024-24990 State: PUBLISHED Published: 2024-02-14T16:30:26.445Z Last Updated: 2025-05-08T15:19:34.642Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: F5 Products: NGINX Plus, NGINX Open Source Problem Types: CWE-416 Description: When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests can cause NGINX worker processes to terminate. Note: The HTTP/3 QUIC module is not enabled by default and is considered experimental. For more information, refer to Support for QUIC and HTTP/3 https://nginx.org/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additi
/en/docs/quic.html . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000138445 - http://www.openwall.com/lists/oss-security/2024/05/30/4
CVE ID: CVE-2024-24991 State: PUBLISHED Published: 2024-04-19T01:10:11.872Z Last Updated: 2024-08-01T23:36:20.586Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Ivanti Products: Avalanche Description: A Null Pointer Dereference vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3 allows an authenticated remote attacker to perform denial of service attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24992 State: PUBLISHED Published: 2024-04-19T01:10:11.959Z Last Updated: 2025-01-07T00:40:56.985Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24993 State: PUBLISHED Published: 2024-04-19T01:10:11.886Z Last Updated: 2024-08-01T23:36:21.233Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24994 State: PUBLISHED Published: 2024-04-19T01:10:11.856Z Last Updated: 2024-08-01T23:36:21.246Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24995 State: PUBLISHED Published: 2024-04-19T01:10:11.896Z Last Updated: 2024-08-01T23:36:21.380Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Race Condition (TOCTOU) vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24996 State: PUBLISHED Published: 2024-04-19T01:10:11.852Z Last Updated: 2025-03-24T21:08:25.157Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24997 State: PUBLISHED Published: 2024-04-19T01:10:11.872Z Last Updated: 2024-08-01T23:36:21.571Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24998 State: PUBLISHED Published: 2024-04-19T01:10:11.897Z Last Updated: 2024-08-01T23:36:21.396Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-24999 State: PUBLISHED Published: 2024-04-19T01:10:11.874Z Last Updated: 2024-08-01T23:36:21.245Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avlanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-25000 State: PUBLISHED Published: 2024-04-19T01:10:12.506Z Last Updated: 2024-08-01T23:36:21.615Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Ivanti Products: Avalanche Description: A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://forums.ivanti.com/s/article/Avalanche-6-4-3-Security-Hardening-and-CVEs-addressed?language=en_US
CVE ID: CVE-2024-25001 State: REJECTED Published: N/A Last Updated: 2024-02-02T08:39:12.517Z Description: No description available.
CVE ID: CVE-2024-25002 State: PUBLISHED Published: 2024-03-25T13:55:15.344Z Last Updated: 2024-08-09T16:21:18.523Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bosch Products: Network Synchronizer Enterprise, Network Synchronizer Standard Problem Types: CWE-78 Description: Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://psirt.bosch.com/security-advisories/BOSCH-SA-152190.html
CVE ID: CVE-2024-25003 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-05-08T18:38:37.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html - http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html - http
6.1.13-Buffer-Overflows.html - http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html - https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004 - http://seclists.org/fulldisclosure/2024/Feb/13 - http://seclists.org/fulldisclosure/2024/Feb/14
CVE ID: CVE-2024-25004 State: PUBLISHED Published: 2024-02-09T00:00:00.000Z Last Updated: 2025-05-15T19:40:29.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://packetstormsecurity.com/files/177032/KiTTY-0.76.1.13-Buffer-Overflows.html - http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Inject
77032/KiTTY-0.76.1.13-Buffer-Overflows.html - http://packetstormsecurity.com/files/177031/KiTTY-0.76.1.13-Command-Injection.html - https://blog.defcesco.io/CVE-2024-25003-CVE-2024-25004 - http://seclists.org/fulldisclosure/2024/Feb/13 - http://seclists.org/fulldisclosure/2024/Feb/14
CVE ID: CVE-2024-25006 State: PUBLISHED Published: 2024-02-02T00:00:00.000Z Last Updated: 2025-05-07T20:09:55.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://xenforo.com/docs/xf2/permissions/ - https://xenforo.com/tickets/BC37EB98/?v=5da7bd5728 - https://xenforo.com/community/threads/xenforo-2-2-14-released.219044/
CVE ID: CVE-2024-25007 State: PUBLISHED Published: 2024-04-04T18:25:21.681Z Last Updated: 2024-08-01T23:36:21.561Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:L) Vendors: Ericsson Products: Ericsson Network Manager Problem Types: CWE-1236 Description: Ericsson Network Manager (ENM), versions prior to 23.1, contains a vulnerability in the export function of application log where Improper Neutralization of Formula Elements in a CSV File can lead to code execution or information disclosure. There is limited impact to integrity and availability. The attacker on the adjacent network with administration access can exploit the vulnerability. Additional Analyst Notes: - CISA
cker on the adjacent network with administration access can exploit the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ericsson.com/en/about-us/security/psirt/security-bulletin--ericsson-network-manager-march-2024
CVE ID: CVE-2024-25008 State: PUBLISHED Published: 2024-08-16T09:42:21.010Z Last Updated: 2024-08-16T13:50:48.465Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Ericsson Products: Ericsson RAN Compute Basebands (all BB variants), Site Controller 6610 Problem Types: CWE-20 Description: Ericsson RAN Compute and Site Controller 6610 contains a vulnerability in the Control System where Improper Input Validation can lead to arbitrary code execution, for example to obtain a Linux Shell with the same privileges as the attacker. The attacker would require elevated privileges for example a valid OAM user having the system administrator role to exploit the vulnerabi
d require elevated privileges for example a valid OAM user having the system administrator role to exploit the vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-ericsson-ran-compute-august-2024
CVE ID: CVE-2024-25009 State: PUBLISHED Published: 2024-08-20T12:00:51.861Z Last Updated: 2024-08-20T13:58:46.180Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Ericsson Products: Packet Core Controller Problem Types: CWE-20 Description: Ericsson Packet Core Controller (PCC) contains a vulnerability in Access and Mobility Management Function (AMF) where improper input validation can lead to denial of service which may result in service degradation. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/security-bulletin-ericsson-packet-core-controller-pcc-august-2024
CVE ID: CVE-2024-25010 State: PUBLISHED Published: 2025-05-22T10:14:00.320Z Last Updated: 2025-05-22T13:20:33.943Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Ericsson Products: Ericsson RAN Compute Basebands (all BB variants), Site Controller 6610 Problem Types: CWE-20 Description: Ericsson RAN Compute and Site Controller 6610 contains in certain configurations a high severity vulnerability where improper input validation could be exploited leading to arbitrary code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/CVE-2024-25010
CVE ID: CVE-2024-25011 State: PUBLISHED Published: 2025-09-18T11:38:18.371Z Last Updated: 2025-09-18T13:31:46.260Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Ericsson Products: Ericsson Catalog Manager, Ericsson Order Care Problem Types: CWE-200 Description: Ericsson Catalog Manager and Ericsson Order Care APIs do not have authentication enabled by default. Authentication checks can be configured to remediate the information disclosure issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ericsson.com/en/about-us/security/psirt/cve-2024-25011
CVE ID: CVE-2024-25015 State: PUBLISHED Published: 2024-05-01T16:16:16.641Z Last Updated: 2024-08-01T23:36:21.594Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-406 Description: IBM MQ 9.2 LTS, 9.3 LTS, and 9.3 CD Internet Pass-Thru could allow a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. IBM X-Force ID: 281278. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149583 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281278
CVE ID: CVE-2024-25016 State: PUBLISHED Published: 2024-03-03T03:09:09.906Z Last Updated: 2024-08-01T23:36:21.339Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: MQ Problem Types: CWE-20 Description: IBM MQ and IBM MQ Appliance 9.0, 9.1, 9.2, 9.3 LTS and 9.3 CD could allow a remote unauthenticated attacker to cause a denial of service due to incorrect buffering logic. IBM X-Force ID: 281279. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7123139 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281279
CVE ID: CVE-2024-25019 State: PUBLISHED Published: 2024-12-03T16:29:12.827Z Last Updated: 2024-12-03T16:49:24.555Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: IBM Products: Cognos Controller Problem Types: CWE-434 Description: IBM Cognos Controller 11.0.0 and 11.0.1 could be vulnerable to malicious file upload by not validating the type of file uploaded to Journal entry attachments. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-25020 State: PUBLISHED Published: 2024-12-03T17:12:31.430Z Last Updated: 2024-12-03T17:55:03.716Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: IBM Products: Cognos Controller Problem Types: CWE-434 Description: IBM Cognos Controller 11.0.0 and 11.0.1 is vulnerable to malicious file upload by allowing unrestricted filetype attachments in the Journal entry page. Attackers can make use of this weakness and upload malicious executable files into the system and can be sent to victims for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177220
CVE ID: CVE-2024-25021 State: PUBLISHED Published: 2024-02-22T11:39:41.641Z Last Updated: 2025-03-27T19:02:47.111Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: AIX Problem Types: CVE-114 Process Control Description: IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary commands. IBM X-Force ID: 281320. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7122628 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281320
CVE ID: CVE-2024-25023 State: PUBLISHED Published: 2024-07-09T23:58:12.459Z Last Updated: 2024-09-21T09:52:56.459Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: CWE-312 Description: IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.22.0 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281429. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7159768 - https://exchange.xforce.ibmcloud.com/vulne
ram Container: References: - https://www.ibm.com/support/pages/node/7159768 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281429
CVE ID: CVE-2024-25024 State: PUBLISHED Published: 2024-08-15T02:42:06.312Z Last Updated: 2025-03-13T19:10:24.949Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: QRadar Suite Software, Cloud Pak for Security Problem Types: 256 Plaintext Storage of a Password Description: IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 and IBM Cloud Pak for Security 1.10.0.0 through 1.10.11.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 281430. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7165488 - https://exchange.xforce.ibmcloud.com/vulnerabiliti
hment: References: - https://www.ibm.com/support/pages/node/7165488 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281430
CVE ID: CVE-2024-25026 State: PUBLISHED Published: 2024-04-25T12:16:24.487Z Last Updated: 2024-08-01T23:36:21.572Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server, WebSphere Application Server Liberty Problem Types: CWE-770 Description: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.4 are vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 281516. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Progra
ver to consume memory resources. IBM X-Force ID: 281516. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7149330 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281516
CVE ID: CVE-2024-25027 State: PUBLISHED Published: 2024-03-31T11:40:11.155Z Last Updated: 2025-11-03T21:53:54.352Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Security Verify Access Docker Problem Types: CWE-311 Description: IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145400 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281607
CVE ID: CVE-2024-25029 State: PUBLISHED Published: 2024-04-06T11:51:45.548Z Last Updated: 2024-08-01T23:36:21.296Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: Personal Communications Problem Types: CWE-119 Description: IBM Personal Communications 14.0.6 through 15.0.1 includes a Windows service that is vulnerable to remote code execution (RCE) and local privilege escalation (LPE). The vulnerability allows any unprivileged user with network access to a target computer to run commands with full privileges in the context of NT AUTHORITY\SYSTEM. This allows for a low privileged attacker to move laterally to affected systems and to escalate thei
T AUTHORITY\SYSTEM. This allows for a low privileged attacker to move laterally to affected systems and to escalate their privileges. IBM X-Force ID: 281619. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7147672 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281619
CVE ID: CVE-2024-25030 State: PUBLISHED Published: 2024-04-03T12:14:19.709Z Last Updated: 2025-02-13T17:40:44.475Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Db2 for Linux, UNIX and Windows Problem Types: CWE-532 Description: IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 281677. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7145725 - https://https://exchange.xforce.ibmcloud.com/vulnerabilities/281677 - https://security.netapp.com
t/pages/node/7145725 - https://https://exchange.xforce.ibmcloud.com/vulnerabilities/281677 - https://security.netapp.com/advisory/ntap-20240517-0006/
CVE ID: CVE-2024-25031 State: PUBLISHED Published: 2024-06-28T18:32:31.632Z Last Updated: 2024-08-01T23:36:21.289Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Storage Defender - Resiliency Service Problem Types: CWE-307 Description: IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.ibm.com/support/pages/node/7158446 - https://exchange.xforce.ibmcloud.com/vulnerabilities/281678
CVE ID: CVE-2024-25034 State: PUBLISHED Published: 2025-01-24T15:25:05.723Z Last Updated: 2025-02-12T20:01:20.029Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Planning Analytics Local Problem Types: CWE-434 Description: IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the type of file in the File Manager T1 process. Attackers can make use of this weakness and upload malicious executable files into the system that can be sent to victims for performing further attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7168387