Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-45059 State: PUBLISHED Published: 2024-08-28T20:17:31.835Z Last Updated: 2024-09-06T19:27:25.280Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: portabilis Products: i-educar Problem Types: CWE-89 Description: i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the `ieducar/intranet/funcionario_vinculo_det.php` file, which creates the query by concatenating the unsanitized GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Co
d GET parameter `cod_func`, allowing the attacker to obtain sensitive information such as emails and password hashes. Commit 7824b95745fa2da6476b9901041d9c854bf52ffe fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/portabilis/i-educar/security/advisories/GHSA-2v4w-7xqr-hxmr - https://github.com/portabilis/i-educar/commit/7824b95745fa2da6476b9901041d9c854bf52ffe - https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html - https://portswigger.net/web-security/sql-injection
CVE ID: CVE-2024-45060 State: PUBLISHED Published: 2024-10-07T20:15:35.087Z Last Updated: 2024-10-08T18:28:48.263Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) Vendors: PHPOffice Products: PhpSpreadsheet Problem Types: CWE-79 Description: PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. One of the sample scripts in PhpSpreadsheet is susceptible to a cross-site scripting (XSS) vulnerability due to improper handling of input where a number is expected leading to formula injection. The code in in `45_Quadratic_equation_solver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take
olver.php` concatenates the user supplied parameters directly into spreadsheet formulas. This allows an attacker to take control over the formula and output unsanitized data into the page, resulting in JavaScript execution. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p - https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56
CVE ID: CVE-2024-45061 State: PUBLISHED Published: 2025-01-15T14:59:27.116Z Last Updated: 2025-01-15T17:02:47.767Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Observium Products: Observium Problem Types: CWE-79 Description: A cross-site scripting (xss) vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-
ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2092
CVE ID: CVE-2024-45062 State: PUBLISHED Published: 2025-08-19T13:54:01.088Z Last Updated: 2025-11-03T19:30:50.152Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OpenPrinting Products: ippusbxd Problem Types: CWE-121 Description: A stack based buffer overflow vulnerability is present in OpenPrinting ippusbxd 1.34. A specially configured printer that supports IPP-over-USB can cause a buffer overflow which can lead to a arbitrary code execution in a privileged service. To trigger the vulnerability, a malicious device would need to be connected to the vulnerable system over USB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Refere
ed to the vulnerable system over USB. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2071
CVE ID: CVE-2024-45063 State: PUBLISHED Published: 2024-09-05T04:31:22.649Z Last Updated: 2025-11-04T16:15:46.470Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-416 Description: The function ctl_write_buffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtio_scsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code ex
constrained by the capabilities available to the bhyve process. A malicious iSCSI initiator could achieve remote code execution on the iSCSI target host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security.freebsd.org/advisories/FreeBSD-SA-24:11.ctl.asc
CVE ID: CVE-2024-45064 State: PUBLISHED Published: 2025-04-02T13:41:58.080Z Last Updated: 2025-04-02T22:03:12.067Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: STMicroelectronics Products: X-CUBE-AZRT-H7RS, X-CUBE-AZRTOS-F4, X-CUBE-AZRTOS-F7, X-CUBE-AZRTOS-G0, X-CUBE-AZRTOS-G4, X-CUBE-AZRTOS-H7, X-CUBE-AZRTOS-L4, X-CUBE-AZRTOS-L5, X-CUBE-AZRTOS-WB, X-CUBE-AZRTOS-WL Problem Types: CWE-119 Description: A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0. A specially crafted set of network packets can lead to code execution. An attacker can send a sequence of requests to trigger
ially crafted set of network packets can lead to code execution. An attacker can send a sequence of requests to trigger this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2024-2096
CVE ID: CVE-2024-45065 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:14:39.386Z Description: No description available.
CVE ID: CVE-2024-45066 State: PUBLISHED Published: 2024-09-24T23:51:02.029Z Last Updated: 2024-09-25T16:54:10.381Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Dover Fueling Solutions (DFS) Products: ProGauge MAGLINK LX CONSOLE, ProGauge MAGLINK LX4 CONSOLE Problem Types: CWE-77 Description: A specially crafted POST request to the ProGauge MAGLINK LX CONSOLE IP sub-menu can allow a remote attacker to inject arbitrary commands. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-24-268-04
CVE ID: CVE-2024-45067 State: PUBLISHED Published: 2025-05-14T22:16:43.735Z Last Updated: 2025-05-17T03:56:07.275Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Gaudi(R) software installers Problem Types: Escalation of Privilege, CWE-276 Description: Incorrect default permissions in some Intel(R) Gaudi(R) software installers before version 1.18 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01271.html
CVE ID: CVE-2024-45068 State: PUBLISHED Published: 2024-12-03T02:32:03.225Z Last Updated: 2024-12-03T15:54:53.646Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: Hitachi Products: Hitachi Ops Center Common Services, Hitachi Ops Center OVA Problem Types: CWE-1392 Description: Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA. This issue affects Hitachi Ops Center Common Services: from 10.9.3-00 before 11.0.3-00; Hitachi Ops Center OVA: from 10.9.3-00 before 11.0.2-01. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls
al Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2024-149/index.html
CVE ID: CVE-2024-45069 State: REJECTED Published: N/A Last Updated: 2025-06-17T02:15:57.260Z Description: No description available.
CVE ID: CVE-2024-45070 State: PUBLISHED Published: 2025-01-07T07:56:57.140Z Last Updated: 2025-01-07T15:32:33.718Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-125 Description: in OpenHarmony v4.1.2 and prior versions allow a local attacker cause information leak through out-of-bounds Read. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2025/2025-01.md
CVE ID: CVE-2024-45071 State: PUBLISHED Published: 2024-10-16T16:20:39.729Z Last Updated: 2024-10-16T18:00:23.907Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-79 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173270
CVE ID: CVE-2024-45072 State: PUBLISHED Published: 2024-10-16T16:12:13.910Z Last Updated: 2024-10-16T18:38:02.173Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-611 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173263
CVE ID: CVE-2024-45073 State: PUBLISHED Published: 2024-09-30T22:00:52.648Z Last Updated: 2024-10-01T14:14:45.175Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-79 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7171755
CVE ID: CVE-2024-45074 State: PUBLISHED Published: 2024-09-04T16:02:16.587Z Last Updated: 2024-09-04T16:18:12.246Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: webMethods Integration Problem Types: CWE-22 Description: IBM webMethods Integration 10.15 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167245
CVE ID: CVE-2024-45075 State: PUBLISHED Published: 2024-09-04T16:01:17.026Z Last Updated: 2025-09-29T17:52:58.134Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Problem Types: CWE-306 Description: IBM webMethods Integration 10.15 could allow an authenticated user to create scheduler tasks that would allow them to escalate their privileges to administrator due to missing authentication. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167245
CVE ID: CVE-2024-45076 State: PUBLISHED Published: 2024-09-04T15:59:07.939Z Last Updated: 2024-09-04T18:29:57.834Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: IBM Products: webMethods Integration Problem Types: CWE-434 Description: IBM webMethods Integration 10.15 could allow an authenticated user to upload and execute arbitrary files which could be executed on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167245
CVE ID: CVE-2024-45077 State: PUBLISHED Published: 2025-01-24T15:38:03.611Z Last Updated: 2025-02-12T20:01:19.525Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-98 Description: IBM Maximo Asset Management 7.6.1.3 MXAPIASSET API is vulnerable to unrestricted file upload which allows authenticated low privileged user to upload restricted file types with a simple method of adding a dot to the end of the file name if Maximo is installed on Windows operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174819
CVE ID: CVE-2024-45081 State: PUBLISHED Published: 2025-02-19T15:37:09.745Z Last Updated: 2025-08-15T14:29:59.475Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: IBM Products: Cognos Controller, Controller Problem Types: CWE-863 Description: IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated user to modify restricted content due to incorrect authorization checks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183597
CVE ID: CVE-2024-45082 State: PUBLISHED Published: 2024-12-18T16:15:12.666Z Last Updated: 2024-12-18T19:36:15.079Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: IBM Products: Cognos Analytics Problem Types: CWE-601 Description: IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: References
r to a malicious Web site that would appear to be trusted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177223
CVE ID: CVE-2024-45084 State: PUBLISHED Published: 2025-02-19T15:24:03.216Z Last Updated: 2025-09-29T17:55:20.228Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: IBM Products: Cognos Controller, Controller Problem Types: CWE-1236 Description: IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 could allow an authenticated attacker to conduct formula injection. An attacker could execute arbitrary commands on the system, caused by improper validation of file contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7183597
CVE ID: CVE-2024-45085 State: PUBLISHED Published: 2024-10-15T21:12:36.664Z Last Updated: 2024-10-16T14:24:08.447Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-754 Description: IBM WebSphere Application Server 8.5 is vulnerable to a denial of service, under certain configurations, caused by an unexpected specially crafted request. A remote attacker could exploit this vulnerability to cause an error resulting in a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7173128
CVE ID: CVE-2024-45086 State: PUBLISHED Published: 2024-11-04T19:29:48.153Z Last Updated: 2024-11-04T20:51:18.956Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-611 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174745
CVE ID: CVE-2024-45087 State: PUBLISHED Published: 2024-11-11T17:06:43.887Z Last Updated: 2024-11-11T17:53:39.033Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: IBM Products: WebSphere Application Server Problem Types: CWE-79 Description: IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7175393
CVE ID: CVE-2024-45088 State: PUBLISHED Published: 2024-11-11T16:01:25.382Z Last Updated: 2024-11-11T17:54:23.187Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Maximo Asset Management Problem Types: CWE-79 Description: IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7174818
CVE ID: CVE-2024-45089 State: PUBLISHED Published: 2025-01-31T15:58:53.150Z Last Updated: 2025-01-31T16:47:45.842Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: IBM Products: Sterling B2B Integrator Problem Types: CWE-203 Description: IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition EBICS server could allow an authenticated user to obtain sensitive filename information due to an observable discrepancy. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7182063
CVE ID: CVE-2024-45091 State: PUBLISHED Published: 2025-01-21T00:41:45.398Z Last Updated: 2025-01-21T16:41:10.360Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: UrbanCode Deploy Problem Types: CWE-532 Description: IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.24, 7.1 through 7.1.2.10, and 7.2 through 7.2.3.13 stores potentially sensitive information in log files that could be read by a local user with access to HTTP request logs. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7177857
CVE ID: CVE-2024-45094 State: PUBLISHED Published: 2025-05-27T22:41:38.125Z Last Updated: 2025-08-26T15:03:31.720Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: IBM Products: Hardware Management Console Problem Types: CWE-79 Description: IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7234276
CVE ID: CVE-2024-45096 State: PUBLISHED Published: 2024-09-05T15:34:22.413Z Last Updated: 2024-09-05T15:47:08.719Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-548 Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167255
CVE ID: CVE-2024-45097 State: PUBLISHED Published: 2024-09-05T15:35:56.186Z Last Updated: 2024-09-05T15:46:21.130Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-650 Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167255
CVE ID: CVE-2024-45098 State: PUBLISHED Published: 2024-09-05T15:31:43.745Z Last Updated: 2024-09-05T15:43:35.370Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: IBM Products: Aspera Faspex Problem Types: CWE-650 Description: IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7167255
CVE ID: CVE-2024-45099 State: PUBLISHED Published: 2024-11-14T12:02:48.903Z Last Updated: 2024-11-14T14:13:23.519Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: IBM Products: Security ReaQta Problem Types: CWE-79 Description: IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7172212
CVE ID: CVE-2024-45100 State: PUBLISHED Published: 2025-01-07T12:22:53.822Z Last Updated: 2025-01-07T14:37:12.190Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: IBM Products: Security QRadar EDR Problem Types: CWE-770 Description: IBM Security ReaQta 3.12 could allow a privileged user to cause a denial of service by sending multiple administration requests due to improper allocation of resources. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.ibm.com/support/pages/node/7180313
CVE ID: CVE-2024-45101 State: PUBLISHED Published: 2024-09-13T17:27:56.092Z Last Updated: 2024-09-13T17:50:38.901Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Lenovo Products: XClarity Administrator Problem Types: CWE-319 Description: A privilege escalation vulnerability was discovered when Single Sign On (SSO) is enabled that could allow an attacker to intercept a valid, authenticated LXCA user’s XCC session if they can convince the user to click on a specially crafted URL. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-154748
CVE ID: CVE-2024-45102 State: PUBLISHED Published: 2025-01-14T21:18:25.798Z Last Updated: 2025-01-15T15:05:26.681Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Lenovo Products: XClarity Administrator Problem Types: CWE-319 Description: A privilege escalation vulnerability was discovered that could allow a valid, authenticated LXCA user to escalate their permissions for a connected XCC instance when using LXCA as a Single Sign On (SSO) provider for XCC instances. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-154748