rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-35853 
In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. This is addressed in 6.0.13 by disabling Lua unless allow-rules is true in the security lua configuration section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35854 
Zoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be exploited to steal the domain controller session token for identity spoofing, thereby achieving the privileges of the domain controller administrator. NOTE: the vendor's perspective is that they have "found no evidence or detail of a security vulnerability."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2023-35855 
A buffer overflow in Counter-Strike through 8684 allows a game server to execute arbitrary code on a remote client's machine by modifying the lservercfgfile console variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35856 
A buffer overflow in Nintendo Mario Kart Wii RMCP01, RMCE01, RMCJ01, and RMCK01 can be exploited by a game client to execute arbitrary code on a client's machine via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35857 
In Siren Investigate before 13.2.2, session keys remain active even after logging out.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35858 
XPath Injection vulnerabilities in the blog and RSS functions of Modern Campus - Omni CMS 2023.1 allow a remote, unauthenticated attacker to obtain application information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2023-35859 
A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to inject arbitrary scripts or HTML via multiple parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2023-35860 
A Directory Traversal vulnerability in Modern Campus - Omni CMS 2023.1 allows a remote, unauthenticated attacker to enumerate file system information via the dir parameter to listing.php or rss.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2023-35861 
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-31T00:00:00.000Z
CVE-2023-35862 
libcoap 4.3.1 contains a buffer over-read via the function coap_parse_oscore_conf_mem at coap_oscore.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35863 
In MADEFORNET HTTP Debugger through 9.12, the Windows service does not set the seclevel registry key before launching the driver. Thus, it is possible for an unprivileged application to obtain a handle to the NetFilterSDK wrapper before the service obtains exclusive access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-07-05T00:00:00.000Z
CVE-2023-35866 
In KeePassXC through 2.7.5, a local attacker can make changes to the Database security settings, including master password and second-factor authentication, within an authenticated KeePassXC Database session, without the need to authenticate these changes by entering the password and/or second-factor authentication to confirm changes. NOTE: the vendor's position is "asking the user for their password prior to making any changes to the database settings adds no additional protection against a local attacker."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-19T00:00:00.000Z
CVE-2023-35867 
An improper handling of a malformed API answer packets to API clients in Bosch BT software products can allow an unauthenticated attacker to cause a Denial of Service (DoS) situation. To exploit this vulnerability an attacker has to replace an existing API server e.g. through Man-in-the-Middle attacks.
Problem types: cwe_id: CWE-703
description: CWE-703 Improper Check or Handling of Exceptional Conditions
Affected products: vendor: Bosch
product: BVMS
vendor: Bosch
product: BVMS Viewer
vendor: Bosch
product: Configuration Manager
vendor: Bosch
product: DIVAR IP 7000 R2
vendor: Bosch
product: DIVAR IP all-in-one 5000
vendor: Bosch
product: DIVAR IP all-in-one 7000
vendor: Bosch
product: DIVAR IP all-in-one 7000 R3
vendor: Bosch
product: DIVAR IP all-in-one 4000
vendor: Bosch
product: DIVAR IP all-in-one 6000
vendor: Bosch
product: Project Assistant
vendor: Bosch
product: Video Security Client
vendor: Bosch
product: BIS Video Engine
vendor: Bosch
product: Intelligent Insights
vendor: Bosch
product: ONVIF Camera Event Driver Tool
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseScore: 5.9
baseSeverity: MEDIUM
Published: 2023-12-18T12:59:48.604Z
CVE-2023-35870 Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resource. Furthermore, a standard template could be deleted, hence making the resource temporarily unavailable.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: SAP_SE
product: SAP S/4HANA (Manage Journal Entry Template)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-07-11T02:40:26.084Z
CVE-2023-35871 Memory Corruption vulnerability in SAP Web Dispatcher
The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.53, HDB 2.00, XS_ADVANCED_RUNTIME 1.00, SAP_EXTENDED_APP_SERVICES 1, has a vulnerability that can be exploited by an unauthenticated attacker to cause memory corruption through logical errors in memory management this may leads to information disclosure or system crashes, which can have low impact on confidentiality and high impact on the integrity and availability of the system.


Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: SAP_SE
product: SAP Web Dispatcher
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2023-07-11T02:41:03.537Z
CVE-2023-35872 Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.


Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: SAP_SE
product: SAP NetWeaver Process Integration (Message Display Tool)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2023-07-11T02:41:33.243Z
CVE-2023-35873 Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product status and its configuration. The vulnerability does not allow access to sensitive information or administrative functionalities. On successful exploitation an attacker can cause limited impact on confidentiality and availability of the application.


Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: SAP_SE
product: SAP NetWeaver Process Integration (Runtime Workbench)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
Published: 2023-07-11T02:42:19.464Z
CVE-2023-35874 Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNEL 7.93, under some conditions, performs improper authentication checks for functionalities that require user identity. An attacker can perform malicious actions over the network, extending the scope of impact, causing a limited impact on confidentiality, integrity and availability.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: SAP_SE
product: SAP NetWeaver AS ABAP and ABAP Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2023-07-11T02:47:11.869Z
CVE-2023-35875 WordPress Gutenverse – Gutenberg Blocks – Page Builder for Site Editor plugin <= 1.8.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Jegstudio Gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse: from n/a through 1.8.5.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Jegstudio
product: Gutenverse
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Mika (Patchstack Alliance)
Published: 2024-12-13T14:23:40.992Z
CVE-2023-35876 WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: WooCommerce
product: WooCommerce Square
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-12-20T14:42:18.072Z
CVE-2023-35877 WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Vadym K.
product: Extra User Details
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-11-13T17:06:24.296Z
CVE-2023-35878 WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Vadym K. Extra User Details plugin <= 0.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Vadym K.
product: Extra User Details
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: LEE SE HYOUNG (Patchstack Alliance)
Published: 2023-06-20T07:57:08.943Z
CVE-2023-35879 WordPress WooCommerce Product Vendors Plugin <= 2.1.78 is vulnerable to SQL Injection
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce Product Vendors allows SQL Injection.This issue affects Product Vendors: from n/a through 2.1.78.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: WooCommerce
product: Product Vendors
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-10-31T14:20:22.918Z
CVE-2023-35880 WordPress WooCommerce Brands Plugin <= 1.6.49 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.49 versions.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: WooCommerce
product: WooCommerce Brands
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2023-07-17T13:40:19.627Z
CVE-2023-35881 WordPress WooCommerce One Page Checkout plugin <= 2.3.0 - Local File Inclusion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WooCommerce WooCommerce One Page Checkout allows PHP Local File Inclusion.This issue affects WooCommerce One Page Checkout: from n/a through 2.3.0.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: WooCommerce
product: WooCommerce One Page Checkout
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.6
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2024-05-17T06:46:48.341Z
CVE-2023-35882 WordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Team Heateor Super Socializer plugin <= 7.13.52 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Team Heateor
product: Super Socializer
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafshanzani Suhada (Patchstack Alliance)
Published: 2023-06-20T07:53:58.274Z
CVE-2023-35883 WordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.This issue affects Core Web Vitals & PageSpeed Booster: from n/a through 1.0.12.
Problem types: cwe_id: CWE-601
description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Affected products: vendor: Magazine3
product: Core Web Vitals & PageSpeed Booster
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Le Ngoc Anh (Patchstack Alliance)
Published: 2023-12-19T20:11:11.659Z
CVE-2023-35884 WordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 3.0.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: EventPrime
product: EventPrime
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Le Ngoc Anh (Patchstack Alliance)
Published: 2023-06-20T06:50:34.373Z
CVE-2023-35885 
CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2023-35887 Apache MINA SSHD: Information disclosure bugs with RootedFilesystem
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache MINA SSHD
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Andrew Pikler
Published: 2023-07-10T09:28:54.987Z
CVE-2023-35888 IBM Security Verify Governance information disclosure
IBM Security Verify Governance 10.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.  IBM X-Force ID:  258375.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: IBM
product: Security Verify Governance
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-03-20T13:25:12.617Z
CVE-2023-35890 IBM WebSphere Application Server information disclosure
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security, caused by the improper encoding in a local configuration file.  IBM X-Force ID:  258637.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: IBM
product: WebSphere Application Server
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2023-07-07T02:13:23.147Z
CVE-2023-35892 IBM Financial Transaction Manager for SWIFT Services XML external entity injection
IBM Financial Transaction Manager for SWIFT Services 3.2.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.  IBM X-Force ID:  258786.
Problem types: cwe_id: CWE-611
description: CWE-611 Improper Restriction of XML External Entity Reference
Affected products: vendor: IBM
product: Financial Transaction Manager for SWIFT Services
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
version: 3.1
Published: 2023-09-04T23:45:38.833Z