rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-52896 IBM MQ information disclosure
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: MQ
cpes: cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-19T17:01:20.061Z
CVE-2024-52897 IBM MQ information disclosure
IBM MQ 9.2 LTS, 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: MQ
cpes: cpe:2.3:a:ibm:mq:9.2.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-12-19T17:18:11.436Z
CVE-2024-52898 IBM MQ information disclosure
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: MQ
cpes: cpe:2.3:a:ibm:mq:9.3.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.3.0:*:*:*:continuous_delivery:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:lts:*:*:*
cpe:2.3:a:ibm:mq:9.4.0:*:*:*:continuous_delivery:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-01-14T16:49:57.674Z
CVE-2024-52899 IBM Data Virtualization Manager code execution
IBM Data Virtualization Manager for z/OS 1.1 and 1.2 could allow an authenticated user to inject malicious JDBC URL parameters and execute code on the server.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: IBM
product: Data Virtualization Manager for z/OS
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-11-26T00:34:19.476Z
CVE-2024-52900 IBM Cognos Analytics cross-site scripting
IBM Cognos Analytics 11.2.0 through 12.2.4 Fix Pack 5 and 12.0.0 through 12.0.4 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Cognos Analytics
cpes: cpe:2.3:a:ibm:cognos_analytics:11.2.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:11.2.4:fix_pack5:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_analytics:12.0.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-06-28T00:59:23.758Z
CVE-2024-52901 IBM InfoSphere Information Server denial of service
IBM InfoSphere Information Server 11.7 could allow an authenticated user to GUI to not load or stop working due to improper input validation.
Problem types: cwe_id: CWE-1284
description: CWE-1284 Improper Validation of Specified Quantity in Input
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-12-12T16:06:31.783Z
CVE-2024-52902 IBM Cognos Controller information disclosure
IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 client application contains hard coded database passwords in source code which could be used for unauthorized access to the system.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:controller:11.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:fix_pack_3:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Controller
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-02-19T14:50:24.376Z
CVE-2024-52903 IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows 12.1.0 and 12.1.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:z:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:z:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-05-01T22:15:48.366Z
CVE-2024-52905 IBM Sterling B2B Integrator information disclosure
IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 could disclose sensitive database information to a privileged user.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: Sterling B2B Integrator Standard Edition
cpes: cpe:2.3:a:ibm:sterling_b2b_integrator:6.0.0.0:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.1.2.6:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.0:*:*:*:standard:*:*:*
cpe:2.3:a:ibm:sterling_b2b_integrator:6.2.0.3:*:*:*:standard:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-03-10T16:05:13.550Z
CVE-2024-52906 IBM AIX denial of service
IBM AIX 7.2, 7.3, VIOS 3.1, and 4.1



could allow a non-privileged local user to exploit a vulnerability in the TCP/IP kernel extension to cause a denial of service.
Problem types: cwe_id: CWE-362
description: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Affected products: vendor: IBM
product: AIX
cpes: cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*
cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:vios:3.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:vios:4.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-12-25T14:48:57.318Z
CVE-2024-52911 
Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-05T00:00:00.000Z
CVE-2024-52912 
Bitcoin Core before 0.21.0 allows a network split that is resultant from an integer overflow (calculating the time offset for newly connecting peers) and an abs64 logic bug.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52913 
In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52914 
In Bitcoin Core before 0.18.0, a node could be stalled for hours when processing the orphans of a crafted unconfirmed transaction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52915 
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption) via a crafted INV message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52916 
Bitcoin Core before 0.15.0 allows a denial of service (OOM kill of a daemon process) via a flood of minimum difficulty headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52917 
Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52918 
Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via a BIP21 r parameter for a URL that has a large file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52919 
Bitcoin Core before 22.0 has a CAddrMan nIdCount integer overflow and resultant assertion failure (and daemon exit) via a flood of addr messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52920 
Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (infinite loop) via a malformed GETDATA message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52921 
In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52922 
In Bitcoin Core before 25.1, an attacker can cause a node to not download the latest block, because there can be minutes of delay when an announcing peer stalls instead of complying with the peer-to-peer protocol specification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52923 
An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of a boundary check during the decoding of DL NAS Transport messages leads to a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2024-52924 
An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, and Modem 5400. Lack of boundary check during the decoding of Registration Accept messages can lead to out-of-bounds writes on the stack
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-06T00:00:00.000Z
CVE-2024-52925 
In OPSWAT MetaDefender Kiosk before 4.7.0, arbitrary code execution can be performed by an attacker via the MD Kiosk Unlock Device feature for software encrypted USB drives.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: OPSWAT
product: MetaDefender Kiosk
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: 2025-02-26T00:00:00.000Z
CVE-2024-52926 
Delinea Privilege Manager before 12.0.2 mishandles the security of the Windows agent.
Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Delinea
product: Privilege Manager
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Osanda Jayathissa of Visa
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52928 
Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new permissions when the user clicks anywhere on the website.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:L/C:H/I:H/PR:N/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: LOW
baseScore: 9.6
baseSeverity: CRITICAL
Published: 2025-06-26T00:00:00.000Z
CVE-2024-52935 GPU DDK - psContext->eDM gives OOB write
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
Problem types: cwe_id: CWE-823
description: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-01-13T10:33:56.052Z
CVE-2024-52936 GPU DDK - rgxfw_hwperf_config OOB read & write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to write data outside the Guest's virtualised GPU memory.
Problem types: cwe_id: CWE-823
description: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-01-13T10:35:41.734Z
CVE-2024-52937 GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore
Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memory.
Problem types: cwe_id: CWE-823
description: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-01-13T10:37:03.187Z
CVE-2024-52938 GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to subvert reconstruction activities to trigger a write of data outside the Guest's virtualised GPU memory.
Problem types: cwe_id: CWE-823
description: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-01-13T11:50:24.185Z
CVE-2024-52939 GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write
Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write data outside the Guest's virtualised GPU memory.
Problem types: cwe_id: CWE-823
description: CWE - CWE-823: Use of Out-of-range Pointer Offset (4.16)
Affected products: vendor: Imagination Technologies
product: Graphics DDK
default_status: unknown
Published: 2025-02-22T14:54:56.218Z
CVE-2024-52940 
AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. The attacker must know the victim's AnyDesk ID.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52941 
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52942 
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24696. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52943 
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24697. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting (XSS) while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52944 
An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24698. It allows an authenticated remote attacker to inject a parameter into an HTTP request, allowing for Cross-Site Scripting while viewing archived content. This could reflect back to an authenticated user without sanitization if executed by that user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:L/I:L/PR:L/S:C/UI:R
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52945 
An issue was discovered in Veritas NetBackup before 10.5. This only applies to NetBackup components running on a Windows Operating System. If a user executes specific NetBackup commands or an attacker uses social engineering techniques to impel the user to execute the commands, a malicious DLL could be loaded, resulting in execution of the attacker's code in the user's security context.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:L/A:H/C:H/I:H/PR:N/S:U/UI:R
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52946 
An issue was discovered in LemonLDAP::NG before 2.20.1. An Improper Check during session refresh allows an authenticated user to raise their authentication level if the admin configured an "Adaptative authentication rule" with an increment instead of an absolute value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52947 
A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter of the upgrade session confirmation page (upgradeSession / forceUpgrade) if the "Upgrade session" plugin has been enabled by an admin
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-18T00:00:00.000Z
CVE-2024-52949 
iptraf-ng 1.2.1 has a stack-based buffer overflow. In src/ifaces.c, the strcpy function consistently fails to control the size, and it is consequently possible to overflow memory on the stack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-16T00:00:00.000Z
CVE-2024-52951 
Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to execute arbitrary code in the browser of a victim via a specially crafted link or by viewing a manipulated Access Request History
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-27T00:00:00.000Z