deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-12024
Published: 2024-12-17
Description: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the em_ticket_category_data and em_ticket_individual_data parameters in all versions up to, and including, 4.0.7.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrative user accesses an injected page.
Note: this vulnerability requires the "Guest Submissions" setting to be enabled. It is disabled by default.
CVSS Score: 7.2 (HIGH)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.0.5.3/admin/partials/metaboxes/meta-box-tickets-panel-html.php#L216; https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.0.5.3/admin/partials/metaboxes/meta-box-tickets-panel-html.php#L264; https://plugins.trac.wordpress.org/browser/eventprime-event-calendar-management/tags/4.0.5.3/includes/class-ep-ajax.php#L1245
CVE: CVE-2024-12127
Published: 2024-12-17
Description: The Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘page’ parameter in all versions up to, and including, 0.0.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-80
References: https://plugins.trac.wordpress.org/changeset/3207940/; https://wordpress.org/plugins/sikshya/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/c0170668-65bc-4d65-a88b-9398391c98d9?source=cve
CVE: CVE-2024-12469
Published: 2024-12-17
Description: The WP BASE Booking of Appointments, Services and Events plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘status’ parameter in all versions up to, and including, 4.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3207855/; https://wordpress.org/plugins/wp-base-booking-of-appointments-services-and-events/#developers; https://www.wordfence.com/threat-intel/vulnerabilities/id/eb6613ad-1fb2-4278-adc1-fe5d1ade3ad5?source=cve
CVE: CVE-2024-8326
Published: 2024-12-17
Description: The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 241114 via the 'sc_get_details' function. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data including user data and database configuration information, which can lead to reading, updating, or dropping database tables. The vulnerability was partially patched in version 241114.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets-in.inc.php; https://plugins.trac.wordpress.org/browser/s2member/trunk/src/includes/classes/sc-gets.inc.php; https://plugins.trac.wordpress.org/changeset/3188157/
CVE: CVE-2024-11280
Published: 2024-12-17
Description: The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been restricted to higher-level roles such as administrator.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3208393/password-protect-page; https://www.wordfence.com/threat-intel/vulnerabilities/id/d9ac0d84-dff4-4a03-a530-cac47ffaf2bb?source=cve
CVE: CVE-2024-12395
Published: 2024-12-17
Description: The WooCommerce Additional Fees On Checkout (Free) plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘number’ parameter in all versions up to, and including, 1.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L117; https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L127; https://plugins.trac.wordpress.org/browser/woo-additional-fees-on-checkout-wordpress/trunk/classes/wps-ext-cst-admin.php#L138
CVE: CVE-2024-12601
Published: 2024-12-17
Description: The Calculated Fields Form plugin for WordPress is vulnerable to Denial of Service in all versions up to, and including, 5.2.63. This is due to unlimited height and width parameters for CAPTCHA images. This makes it possible for unauthenticated attackers to send multiple requests with large values, resulting in slowing server resources if the server does not mitigate Denial of Service attacks.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L74; https://plugins.trac.wordpress.org/browser/calculated-fields-form/trunk/captcha/captcha.php#L75; https://plugins.trac.wordpress.org/changeset/3207826/
CVE: CVE-2024-52542
Published: 2024-12-17
Description: Dell AppSync, version 4.6.0.x, contain a Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information tampering.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-61, CWE-59
References: https://www.dell.com/support/kbdoc/en-us/000261039/dsa-2024-496-security-update-for-dell-appsync-vulnerabilities
CVE: CVE-2024-8429
Published: 2024-12-17
Description: Improper Restriction of Excessive Authentication Attempts vulnerability in Digital Operation Services WiFiBurada allows Use of Known Domain Credentials.This issue affects WiFiBurada: before 1.0.5.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-201, CWE-307
References: https://www.usom.gov.tr/bildirim/tr-24-1888
CVE: CVE-2024-8475
Published: 2024-12-17
Description: Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables.This issue affects WiFiBurada: before 1.0.5.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-302, CWE-799
References: https://www.usom.gov.tr/bildirim/tr-24-1888
CVE: CVE-2024-9654
Published: 2024-12-17
Description: The Easy Digital Downloads plugin for WordPress is vulnerable to Improper Authorization in versions 3.1 through 3.3.4. This is due to a lack of sufficient validation checks within the 'verify_guest_email' function to ensure the requesting user is the intended recipient of the purchase receipt. This makes it possible for unauthenticated attackers to bypass intended security restrictions and view the receipts of other users, which contains a link to download paid content. Successful exploitation requires knowledge of another customers email address as well as the file ID of the content they purchased.
CVSS Score: 3.7 (LOW)
CWE: CWE-863
References: https://plugins.trac.wordpress.org/changeset/3188001/easy-digital-downloads/trunk/includes/blocks/includes/orders/functions.php?old=2990247&old_path=easy-digital-downloads%2Ftrunk%2Fincludes%2Fblocks%2Fincludes%2Forders%2Ffunctions.php; https://www.wordfence.com/threat-intel/vulnerabilities/id/d3f4de75-abf5-46e8-854d-be91ed74a5f3?source=cve
CVE: CVE-2024-10356
Published: 2024-12-17
Description: The ElementsReady Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.4.8 in inc/Widgets/accordion/output/content.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/changeset/3204333/element-ready-lite; https://www.wordfence.com/threat-intel/vulnerabilities/id/b0a48c91-7e2c-4708-b5af-dfbcfea08f83?source=cve
CVE: CVE-2024-50379
Published: 2024-12-17
Description: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write (non-default configuration).

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.0.97.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-367
References: https://lists.apache.org/thread/y6lj6q1xnp822g6ro70tn19sgtjmr80r; http://www.openwall.com/lists/oss-security/2024/12/17/4; http://www.openwall.com/lists/oss-security/2024/12/18/2
CVE: CVE-2024-54677
Published: 2024-12-17
Description: Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97.
The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions 
may also be affected.


Users are recommended to upgrade to version 11.0.2, 10.1.34 or 9.0.98, which fixes the issue.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-400
References: https://lists.apache.org/thread/tdtbbxpg5trdwc2wnopcth9ccvdftq2n; http://www.openwall.com/lists/oss-security/2024/12/17/5; http://www.openwall.com/lists/oss-security/2024/12/17/6
CVE: CVE-2024-9819
Published: 2024-12-17
Description: Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse.This issue affects NG Analyser: before 2.2.711.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639
References: https://www.usom.gov.tr/bildirim/tr-24-1889
CVE: CVE-2024-8972
Published: 2024-12-17
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobil365 Informatics Saha365 App allows SQL Injection.This issue affects Saha365 App: before 30.09.2024.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.usom.gov.tr/bildirim/tr-24-1890
CVE: CVE-2024-36831
Published: 2024-12-17
Description: A NULL pointer dereference in the plugins_call_handle_uri_clean function of D-Link DAP-1520 REVA_FIRMWARE_1.10B04_BETA02_HOTFIX allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request without authentication.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-476
References: https://docs.google.com/document/d/15CVb7XHIgtfeW1W1pLZJWvlBMYN1rtr75vqZqf1v3Eo/edit?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10395; https://www.dlink.com/en
CVE: CVE-2024-36832
Published: 2024-12-17
Description: A NULL pointer dereference in D-Link DAP-1513 REVA_FIRMWARE_1.01 allows attackers to cause a Denial of Service (DoS) via a crafted web request without authentication. The vulnerability occurs in the /bin/webs binary of the firmware. When /bin/webs receives a carefully constructed HTTP request, it will crash and exit due to a null pointer reference, leading to a denial of service attack to the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://docs.google.com/document/d/1qTpwAg7B5E4mqkBzijjuoOWWnf3OE1HXIKBv7OcS8Mc/edit?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10396; https://www.dlink.com/en
CVE: CVE-2024-37605
Published: 2024-12-17
Description: A NULL pointer dereference in D-Link DIR-860L REVB_FIRMWARE_2.04.B04_ic5b allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-476
References: https://docs.google.com/document/d/1cWlVLaVvr_xzkqbKIXY7EW89hNHE89SSlNtesv6lzl8/edit?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10397; https://www.dlink.com/en
CVE: CVE-2024-37606
Published: 2024-12-17
Description: A Stack overflow vulnerability in D-Link DCS-932L REVB_FIRMWARE_2.18.01 allows attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://docs.google.com/document/d/1qWJh2jgEhmyeW3OefMQNsrlKdATMSU6Twjkk1p3qfAs/edit?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10247; https://www.dlink.com/en
CVE: CVE-2024-37607
Published: 2024-12-17
Description: A Buffer overflow vulnerability in D-Link DAP-2555 REVA_FIRMWARE_1.20 allows remote attackers to cause a Denial of Service (DoS) via a crafted HTTP request.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-120
References: https://docs.google.com/document/d/1haRDAIN8SbAF8qKNHAm1awnI_LCAPauR8T_pbFREnMM/edit?usp=sharing; https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10232; https://www.dlink.com/en
CVE: CVE-2024-10476
Published: 2024-12-17
Description: Default credentials are used in the above listed BD Diagnostic Solutions products. If exploited, threat actors may be able to access, modify or delete data, including sensitive information such as protected health information (PHI) and personally identifiable information (PII). Exploitation of this vulnerability may allow an attacker to shut down or otherwise impact the availability of the system. Note: BD Synapsys™ Informatics
Solution is only in scope of
this vulnerability when
installed on a NUC server. BD Synapsys™
Informatics Solution installed
on a customer-provided virtual machine or on the BD Kiestra™ SCU hardware is
not in scope.
CVSS Score: 8.0 (HIGH)
CWE: CWE-1392
References: https://www.bd.com/en-us/about-bd/cybersecurity/bulletin/bd-cybersecurity-vulnerability-bulletin-diagnostic-solutions-products
CVE: CVE-2024-11422
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Write vulnerability. A malicious actor can leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12178
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12179
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12191
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12192
Published: 2024-12-17
Description: A maliciously crafted DWF file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12193
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12194
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12197
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12198
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12199
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12200
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12669
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12670
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can be used to cause a Heap-based Overflow vulnerability. A malicious actor can leverage this vulnerability to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-12671
Published: 2024-12-17
Description: A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, may force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://www.autodesk.com/trust/security-advisories/adsk-sa-2024-0027
CVE: CVE-2024-53144
Published: 2024-12-17
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE

This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4
("Bluetooth: Always request for user confirmation for Just Works")
always request user confirmation with confirm_hint set since the
likes of bluetoothd have dedicated policy around JUST_WORKS method
(e.g. main.conf:JustWorksRepairing).

CVE: CVE-2024-8805
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/22b49d6e4f399a390c70f3034f5fbacbb9413858; https://git.kernel.org/stable/c/5291ff856d2c5177b4fe9c18828312be30213193; https://git.kernel.org/stable/c/830c03e58beb70b99349760f822e505ecb4eeb7e
CVE: CVE-2024-42194
Published: 2024-12-17
Description: An improper handling of insufficient permissions or privileges affects HCL BigFix Inventory.  An attacker having access via a read-only account can possibly change certain configuration parameters by crafting a specific REST API call.
CVSS Score: 3.1 (LOW)
CWE: CWE-280
References: https://https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0118212
CVE: CVE-2024-49816
Published: 2024-12-17
Description: IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-532
References: https://www.ibm.com/support/pages/node/7175067
CVE: CVE-2024-49817
Published: 2024-12-17
Description: IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 stores user credentials in configuration files which can be read by a local privileged user.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-260, CWE-522
References: https://www.ibm.com/support/pages/node/7175067
CVE: CVE-2024-49818
Published: 2024-12-17
Description: IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 

could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-209
References: https://www.ibm.com/support/pages/node/7175067
CVE: CVE-2024-49819
Published: 2024-12-17
Description: IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information in cleartext in a communication channel that can be sniffed by unauthorized actors.
CVSS Score: 4.1 (MEDIUM)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7175067
CVE: CVE-2024-49820
Published: 2024-12-17
Description: IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.
CVSS Score: 3.7 (LOW)
CWE: CWE-319
References: https://www.ibm.com/support/pages/node/7175067