rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-34993 
In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaShop, a guest can perform SQL injection via`GenerateCategories::renderCategories().
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-19T00:00:00.000Z
CVE-2024-34994 
In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFeedModuleFrontController::postProcess()`.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-19T00:00:00.000Z
CVE-2024-34995 
svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. This vulnerability allows attackers to delete arbitrary files via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-24T16:11:15.387Z
CVE-2024-34997 
joblib v1.4.2 was discovered to contain a deserialization vulnerability via the component joblib.numpy_pickle::NumpyArrayWrapper().read_array(). NOTE: this is disputed by the supplier because NumpyArrayWrapper is only used during caching of trusted content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T00:00:00.000Z
CVE-2024-35009 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=&fieldName=state&fieldName2=state&tabName=banner&dataID=6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T13:58:28.753Z
CVE-2024-35010 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/banner_deal.php?mudi=del&dataType=&dataTypeCN=%E5%9B%BE%E7%89%87%E5%B9%BF%E5%91%8A&theme=cs&dataID=6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T13:58:30.067Z
CVE-2024-35011 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=rev&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T13:58:31.002Z
CVE-2024-35012 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoType_deal.php?mudi=add&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-14T13:58:31.739Z
CVE-2024-35039 
idccms V1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via admin/tplSys_deal.php?mudi=area.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-16T14:29:42.759Z
CVE-2024-35048 
An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T13:20:25.536Z
CVE-2024-35049 
SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022-25590.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T13:20:26.015Z
CVE-2024-35050 
An issue in SurveyKing v1.3.1 allows attackers to escalate privileges via re-using the session ID of a user that was deleted by an Admin.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T13:20:26.038Z
CVE-2024-35056 
NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35057 
An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35058 
An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35059 
An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35060 
An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplying a crafted YAML file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35061 
NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-21T00:00:00.000Z
CVE-2024-35079 
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T18:51:25.543Z
CVE-2024-35080 
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T18:50:01.968Z
CVE-2024-35081 
LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T17:02:08.098Z
CVE-2024-35082 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:58:35.540Z
CVE-2024-35083 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:46:29.921Z
CVE-2024-35084 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:57:22.359Z
CVE-2024-35085 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in ProcessDefinitionMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:53:52.301Z
CVE-2024-35086 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T17:00:14.564Z
CVE-2024-35090 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T16:52:15.057Z
CVE-2024-35091 
J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysTenantMapper.xml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-23T17:04:00.012Z
CVE-2024-35099 
TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the function loginAuth.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-13T19:25:41.081Z
CVE-2024-35102 
Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T18:25:34.067Z
CVE-2024-35106 
NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. This vulnerability allows attackers to cause a Denial of Service (DoS) or potentially arbitrary code execution via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-35108 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/homePro_deal.php?mudi=del&dataType=&dataTypeCN.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T02:03:21.810Z
CVE-2024-35109 
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /homePro_deal.php?mudi=add&nohrefStr=close.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-15T02:03:23.635Z
CVE-2024-35110 
A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-05-17T08:00:44.953Z
CVE-2024-35111 IBM Control Center information disclosure
IBM Control Center 6.2.1 and 6.3.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Control Center
cpes: cpe:2.3:a:ibm:control_center:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:control_center:6.3.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-25T13:29:55.296Z
CVE-2024-35112 IBM Control Center cross-site scripting
IBM Control Center 6.2.1 and 6.3.1 

could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-80
description: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected products: vendor: IBM
product: Control Center
cpes: cpe:2.3:a:ibm:control_center:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:control_center:6.3.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-01-25T13:31:25.755Z
CVE-2024-35113 IBM Control Center information disclosure
IBM Control Center 6.2.1 and 6.3.1 



could allow an authenticated user to obtain sensitive information exposed through a directory listing.
Problem types: cwe_id: CWE-548
description: CWE-548 Exposure of Information Through Directory Listing
Affected products: vendor: IBM
product: Control Center
cpes: cpe:2.3:a:ibm:control_center:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:control_center:6.3.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-25T13:32:39.872Z
CVE-2024-35114 IBM Control Center information disclosure
IBM Control Center 6.2.1 and 6.3.1 





could allow a remote attacker to enumerate usernames due to an observable discrepancy between login attempts.
Problem types: cwe_id: CWE-204
description: CWE-204 Response Discrepancy Information Exposure
Affected products: vendor: IBM
product: Control Center
cpes: cpe:2.3:a:ibm:control_center:6.2.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:control_center:6.3.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-25T13:33:25.352Z
CVE-2024-35116 IBM MQ denial of service
IBM MQ 9.0 LTS, 9.1 LTS, 9.2 LTS, 9.3 LTS, and 9.3 CD is vulnerable to a denial of service attack caused by an error applying configuration changes.  IBM X-Force ID:  290335.
Problem types: cwe_id: CWE-789
description: CWE-789 Uncontrolled Memory Allocation
Affected products: vendor: IBM
product: MQ
cpes: cpe:2.3:a:ibm:mq_appliance:9.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.1:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.2:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq_appliance:9.3:*:*:*:continuous_delivery:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-06-28T18:20:50.152Z
CVE-2024-35117 IBM OpenPages with Watson information disclosure
IBM OpenPages with Watson 9.0 may write sensitive information, under specific configurations, in clear text to the system tracing log files that could be obtained by a privileged user.
Problem types: cwe_id: CWE-312
description: CWE-312 Cleartext Storage of Sensitive Information
Affected products: vendor: IBM
product: OpenPages with Watson
cpes: cpe:2.3:a:ibm:openpages_with_watson:9.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-11T01:32:32.066Z
CVE-2024-35118 IBM MaaS360 information disclosure
IBM MaaS360 for Android 6.31 through 8.60 is using hard coded credentials that can be obtained by a user with physical access to the device.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: IBM
product: MaaS360
cpes: cpe:2.3:a:ibm:maas360:6.31:*:*:*:*:android:*:*
cpe:2.3:a:ibm:maas360:8.60:*:*:*:*:android:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: NONE
baseScore: 4.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-08-29T15:20:02.246Z
CVE-2024-35119 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace.  This information could be used in further attacks against the system.  IBM X-Force ID:  290342.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-06-30T16:36:37.299Z
CVE-2024-35122 IBM i denial of service
IBM i 7.2, 7.3, 7.4, and 7.5 is vulnerable to a file level local denial of service caused by an insufficient authority requirement. A local non-privileged user can configure a referential constraint with the privileges of a user socially engineered to access the target file.
Problem types: cwe_id: CWE-266
description: CWE-266 Incorrect Privilege Assignment
Affected products: vendor: IBM
product: i
cpes: cpe:2.3:a:ibm:i:7.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-01-24T17:27:26.745Z
CVE-2024-35124 IBM OpenBMC authentication bypass
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC.  IBM X-Force ID:  290674.
Problem types: cwe_id: CWE-288
description: CWE-288
Affected products: vendor: IBM
product: OpenBMC
cpes: cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:*
cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:*
cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-08-13T11:14:40.227Z
CVE-2024-35133 IBM Security Verify Access HTTP open redirect
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: IBM
product: Security Verify Access
cpes: cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.8:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_docker:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_docker:10.0.8:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Security Verify Access Docker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
version: 3.1
Published: 2024-08-29T16:39:43.913Z
CVE-2024-35134 IBM Analytics Content Hub information disclosure
IBM Analytics Content Hub 2.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Analytics Content Hub
cpes: cpe:2.3:a:ibm:analytics_content_hub:2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-25T14:05:45.345Z
CVE-2024-35136 IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) federated server 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain non default conditions.  IBM X-Force ID:  291307.
Problem types: cwe_id: CWE-943
description: CWE-943 Improper Neutralization of Special Elements in Data Query Logic
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:10.5:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:10.5:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:windows:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-08-14T17:36:09.003Z
CVE-2024-35137 IBM Security Access Manager Docker information disclosure
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed.   IBM X-Force ID:  292413.
Problem types: cwe_id: CWE-258
description: CWE-258 Empty Password in Configuration File
Affected products: vendor: IBM
product: Security Verify Access Docker
cpes: cpe:2.3:a:ibm:security_verify_access_docker:10.0.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_docker:10.0.7.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-06-28T15:33:11.156Z
CVE-2024-35138 IBM Security Verify Access cross-site request forgery
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: IBM
product: Security Verify Access Appliance
default_status: unaffected
vendor: IBM
product: Security Verify Access Container
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-02-04T20:38:34.306Z