deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-20045
Published: 2025-02-05
Description: When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: https://my.f5.com/manage/s/article/K000138932
CVE: CVE-2025-20058
Published: 2025-02-05
Description: When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://my.f5.com/manage/s/article/K000140947
CVE: CVE-2025-21087
Published: 2025-02-05
Description: When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://my.f5.com/manage/s/article/K000134888
CVE: CVE-2025-21091
Published: 2025-02-05
Description: When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVSS Score: 7.5 (HIGH)
CWE: CWE-401
References: https://my.f5.com/manage/s/article/K000140933
CVE: CVE-2025-22846
Published: 2025-02-05
Description: When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.



  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: https://my.f5.com/manage/s/article/K000139780
CVE: CVE-2025-22891
Published: 2025-02-05
Description: When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-772
References: https://my.f5.com/manage/s/article/K000139778
CVE: CVE-2025-23239
Published: 2025-02-05
Description: When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.7 (HIGH)
CWE: CWE-77
References: https://my.f5.com/manage/s/article/K000138757
CVE: CVE-2025-23412
Published: 2025-02-05
Description: When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate.



 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://my.f5.com/manage/s/article/K000141003
CVE: CVE-2025-23413
Published: 2025-02-05
Description: When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-532
References: https://my.f5.com/manage/s/article/K000149185
CVE: CVE-2025-23415
Published: 2025-02-05
Description: An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux.

 




Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 3.1 (LOW)
CWE: CWE-345
References: https://my.f5.com/manage/s/article/K000139656
CVE: CVE-2025-23419
Published: 2025-02-05
Description: When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when  TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key  are used and/or the  SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache  are used in the default server and the default server is performing client certificate authentication.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-863, CWE-863
References: https://my.f5.com/manage/s/article/K000149173; http://www.openwall.com/lists/oss-security/2025/02/05/8; https://lists.debian.org/debian-lts-announce/2025/03/msg00017.html
CVE: CVE-2025-24312
Published: 2025-02-05
Description: When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization.  

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-770
References: https://my.f5.com/manage/s/article/K000141380
CVE: CVE-2025-24319
Published: 2025-02-05
Description: When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate.



 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://my.f5.com/manage/s/article/K000148412
CVE: CVE-2025-24320
Published: 2025-02-05
Description: A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for  CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 . 

Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 8.0 (HIGH)
CWE: CWE-79
References: https://my.f5.com/manage/s/article/K000140578
CVE: CVE-2025-24326
Published: 2025-02-05
Description: When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization.

 


Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://my.f5.com/manage/s/article/K000140950
CVE: CVE-2025-24497
Published: 2025-02-05
Description: When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://my.f5.com/manage/s/article/K000140920
CVE: CVE-2025-24372
Published: 2025-02-05
Description: CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a file containing code that when executed could send arbitrary requests to the server. If that file was opened by an administrator, it could lead to escalation of privileges of the original submitter or other malicious actions. Users must have been registered to the site to exploit this vulnerability. This vulnerability has been fixed in CKAN 2.10.7 and 2.11.2. Users are advised to upgrade. On versions prior to CKAN 2.10.7 and 2.11.2, site maintainers can restrict the file types supported for uploading using the `ckan.upload.user.mimetypes` / `ckan.upload.user.types` and `ckan.upload.group.mimetypes` / `ckan.upload.group.types` config options. To entirely disable file uploads users can use: `ckan.upload.user.types = none`
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-mimetypes; https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-group-types; https://docs.ckan.org/en/latest/maintaining/configuration.html#ckan-upload-user-mimetypes
CVE: CVE-2025-24803
Published: 2025-02-05
Description: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. The `dynamic_analysis.html` file does not sanitize the received bundle value from Corellium and as a result, it is possible to break the HTML context and achieve Stored XSS. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier; https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-cxqq-w3x5-7ph3
CVE: CVE-2025-24804
Published: 2025-02-05
Description: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. According to Apple's documentation for bundle ID's, it must contain only alphanumeric characters (A–Z, a–z, and 0–9), hyphens (-), and periods (.). However, an attacker can manually modify this value in the `Info.plist` file and add special characters to the `<key>CFBundleIdentifier</key>` value. When the application parses the wrong characters in the bundle ID, it encounters an error. As a result, it will not display content and will throw a 500 error instead. The only way to make the pages work again is to manually remove the malicious application from the system. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1287
References: https://developer.apple.com/documentation/bundleresources/information-property-list/cfbundleidentifier; https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-jrm8-xgf3-fwqr
CVE: CVE-2025-24805
Published: 2025-02-05
Description: Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework. A local user with minimal privileges is able to make use of an access token for materials for scopes which it should not be accepted. This issue has been addressed in version 4.3.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-269
References: https://github.com/MobSF/Mobile-Security-Framework-MobSF/commit/05206e72cae35b311615a70e51e1a946955c5e83; https://github.com/MobSF/Mobile-Security-Framework-MobSF/security/advisories/GHSA-79f6-p65j-3m2m
CVE: CVE-2020-36084
Published: 2025-02-05
Description: SQL Injection vulnerability in SourceCodester Responsive E-Learning System 1.0 allows remote attackers to inject sql query in /elearning/delete_teacher_students.php?id= parameter via id field.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/49357
CVE: CVE-2024-48394
Published: 2025-02-05
Description: A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unprivileged user to exploit this flaw and gain SYSTEM-level access on the device. The vulnerability affects version 5.24.3 and before of the software.
CVSS Score: 7.8 (HIGH)
CWE: CWE-367
References: https://helpcenter-nddprint.ndd.tech/pt/seguranca-e-compliance/Current/dezembro-2024#0
CVE: CVE-2024-54853
Published: 2025-02-05
Description: A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows remote authenticated users to store malicious payloads in the affected field that would then execute in an unsuspecting victim's browser.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/KoratSec/CVEs/blob/main/CVE-2024-54853.txt
CVE: CVE-2024-57063
Published: 2025-02-05
Description: A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/dcb93b4788273c3ffb15f70dc45ca4e7
CVE: CVE-2024-57064
Published: 2025-02-05
Description: A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. NOTE: the Supplier disputes this because they found that the lib.setValue function is not utilized.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/1b40dc7f[PII_REDACTED]c[PII_REDACTED]60e
CVE: CVE-2024-57065
Published: 2025-02-05
Description: A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/7b2c50ccdec39a030091e48a4ccde688
CVE: CVE-2024-57066
Published: 2025-02-05
Description: A prototype pollution in the lib.deep function of @ndhoule/defaults v2.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/8ee7327cc8b78df738cd32505cbbbd44
CVE: CVE-2024-57067
Published: 2025-02-05
Description: A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/07dca101d8fe059dd11b3b0e1b4a6d46
CVE: CVE-2024-57068
Published: 2025-02-05
Description: A prototype pollution in the lib.mutateMergeDeep function of @tanstack/form-core v0.35.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: https://gist.github.com/tariqhawis/47fe5b1e584e9e573c[PII_REDACTED]d533
CVE: CVE-2024-57069
Published: 2025-02-05
Description: A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/68e06b00e3258d0d427257c6906bd300; https://gist.github.com/tariqhawis/68e06b00e3258d0d427257c6906bd300
CVE: CVE-2024-57071
Published: 2025-02-05
Description: A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/b56500d3a8866467ee769df7453eedaa; https://gist.github.com/tariqhawis/b56500d3a8866467ee769df7453eedaa
CVE: CVE-2024-57072
Published: 2025-02-05
Description: A prototype pollution in the lib.requireFromString function of module-from-string v3.3.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/8b1fe301dd1ea52952cef347daddee67
CVE: CVE-2024-57074
Published: 2025-02-05
Description: A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/82e3eb472d03273a74e40242e8356297
CVE: CVE-2024-57075
Published: 2025-02-05
Description: A prototype pollution in the lib.Logger function of eazy-logger v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/c601f7f85146510ca899a7406a03aba5
CVE: CVE-2024-57076
Published: 2025-02-05
Description: A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/c432b93ee7d967c2e65bc1bf39241664
CVE: CVE-2024-57077
Published: 2025-02-05
Description: The latest version of utils-extend (1.0.8) is vulnerable to Prototype Pollution through the entry function(s) lib.extend. An attacker can supply a payload with Object.prototype setter to introduce or modify properties within the global prototype chain, causing denial of service (DoS) a the minimum consequence.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/64bac50f8c2706e6880e45d50a507114
CVE: CVE-2024-57078
Published: 2025-02-05
Description: A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/b58d7274d67e7b9fed4bd51368388a23
CVE: CVE-2024-57079
Published: 2025-02-05
Description: A prototype pollution in the lib.deepMerge function of @zag-js/core v0.50.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/4778fc57084766b7b7fb6d25d20b7b9b
CVE: CVE-2024-57080
Published: 2025-02-05
Description: A prototype pollution in the lib.install function of vxe-table v4.8.10 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/c0b5fa2d7e4edd3f000e73fb7a10ccbc; https://gist.github.com/tariqhawis/c0b5fa2d7e4edd3f000e73fb7a10ccbc
CVE: CVE-2024-57081
Published: 2025-02-05
Description: A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/4b2c7273054f0d70ef162aa5b6daec01
CVE: CVE-2024-57082
Published: 2025-02-05
Description: A prototype pollution in the lib.createUploader function of @rpldy/uploader v1.8.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/708e518de0c3b5af7430ec774f68f315
CVE: CVE-2024-57084
Published: 2025-02-05
Description: A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/3dbeb208c3e22f90a601818ccd06a948
CVE: CVE-2024-57085
Published: 2025-02-05
Description: A prototype pollution in the function deepMerge of @stryker-mutator/util v8.6.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://gist.github.com/tariqhawis/f59355f62dad6f8b53b42317f143ba0c
CVE: CVE-2024-57086
Published: 2025-02-05
Description: A prototype pollution in the function fieldsToJson of node-opcua-alarm-condition v2.134.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.
CVSS Score: 7.5 (HIGH)
CWE: CWE-1321
References: https://gist.github.com/tariqhawis/30acc3632cf595ca5825b7ec2b2f795a; https://gist.github.com/tariqhawis/30acc3632cf595ca5825b7ec2b2f795a
CVE: CVE-2024-57520
Published: 2025-02-05
Description: Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: https://gist.github.com/hyp164D1/ae76ab25acfbe263b2ed7b24b6e5c621; https://github.com/asterisk/asterisk/issues/1122
CVE: CVE-2024-57598
Published: 2025-02-05
Description: A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remote attacker to cause a denial of service vulnerability.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: http://bento4.com; https://github.com/JWH-96/Bugs-disclosure/blob/main/Bento4_FPE.md
CVE: CVE-2024-57699
Published: 2025-02-05
Description: A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.
CVSS Score: 7.5 (HIGH)
CWE: CWE-674
References: https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699; https://nvd.nist.gov/vuln/detail/cve-2023-1370
CVE: CVE-2024-38316
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-38317
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6  is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-38318
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-80, CWE-79
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-56470
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6  is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/7182490
CVE: CVE-2024-56471
Published: 2025-02-05
Description: IBM Aspera Shares 1.9.0 through 1.10.0 PL6  is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-918
References: https://www.ibm.com/support/pages/node/7182490