rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-45652 IBM Maximo Asset Management directory traversal
IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: IBM
product: Maximo Asset Management
cpes: cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-01-19T02:42:18.748Z
CVE-2024-45653 IBM Sterling Connect:Direct Web Services information disclosure
IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: IBM
product: Sterling Connect:Direct Web Services
cpes: cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.0.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.0.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:unix:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-19T02:39:30.681Z
CVE-2024-45654 IBM Security ReaQta improper input validation
IBM Security ReaQta 3.12 could allow an authenticated user to perform unauthorized actions due to reliance on untrusted inputs.
Problem types: cwe_id: CWE-807
description: CWE-807 Reliance on Untrusted Inputs in a Security Decision
Affected products: vendor: IBM
product: Security ReaQta
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-01-19T02:19:11.978Z
CVE-2024-45655 IBM Application Gateway incorrect permission assignment
IBM Application Gateway 19.12 through 24.09 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: IBM
product: Application Gateway
cpes: cpe:2.3:a:ibm:application_gateway:19.12:*:*:*:*:*:*:*
cpe:2.3:a:ibm:application_gateway:24.09:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
version: 3.1
Published: 2025-06-03T14:48:55.648Z
CVE-2024-45656 IBM Flexible Service Processor hard coded credentials
IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: IBM
product: Flexible Service Processor
cpes: cpe:2.3:o:ibm:power9_system_firmware:fw1060.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1050.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw1030.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw950.00:*:*:*:*:*:*:*
cpe:2.3:o:ibm:power9_system_firmware:fw860.00:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-10-29T00:37:16.004Z
CVE-2024-45657 IBM Security Verify Access incorrect privilege assignment
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a local privileged user to perform unauthorized actions due to incorrect permissions assignment.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: IBM
product: Security Verify Access Appliance
default_status: unaffected
vendor: IBM
product: Security Verify Access Container
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
version: 3.1
Published: 2025-02-04T20:40:08.652Z
CVE-2024-45658 IBM Security Verify Access information disclosure
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Security Verify Access Appliance
default_status: unaffected
vendor: IBM
product: Security Verify Access Container
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-04T20:37:13.537Z
CVE-2024-45659 IBM Security Verify Access information disclosure
IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Security Verify Access Appliance
default_status: unaffected
vendor: IBM
product: Security Verify Access Container
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-04T17:34:12.764Z
CVE-2024-45662 IBM Safer Payments denial of service
IBM Safer Payments 6.4.0.00 through 6.4.2.07, 6.5.0.00 through 6.5.0.05, and 6.6.0.00 through 6.6.0.03 could allow a remote attacker to cause a denial of service due to improper allocation of resources.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: Safer Payments
cpes: cpe:2.3:a:ibm:safer_payments:6.4.0.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:safer_payments:6.4.2.07:*:*:*:*:*:*:*
cpe:2.3:a:ibm:safer_payments:6.5.0.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:safer_payments:6.5.0.05:*:*:*:*:*:*:*
cpe:2.3:a:ibm:safer_payments:6.6.0.00:*:*:*:*:*:*:*
cpe:2.3:a:ibm:safer_payments:6.6.0.03:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-18T16:19:46.770Z
CVE-2024-45663 IBM Db2 denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1, 11.5, and 12.1 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Problem types: description: CWE 789 Uncontrolled Memory Allocation
Affected products: vendor: IBM
product: Db2 for Linux, UNIX and Windows
cpes: cpe:2.3:a:ibm:db2:11.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:11.1:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:11.5:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1:*:*:*:*:hp-ux:*:*
cpe:2.3:a:ibm:db2:12.1:*:*:*:*:windows:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-11-21T00:22:03.293Z
CVE-2024-45669 IBM Security Verify Information Queue denial of service
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 could allow a remote user to cause a denial of service due to improper handling of special characters that could lead to uncontrolled resource consumption.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: Security Verify Information Queue
cpes: cpe:2.3:a:ibm:security_verify_information_queue:10.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.8:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-09-10T20:06:58.159Z
CVE-2024-45670 IBM Security SOAR weak password recovery mechanism
IBM Security SOAR 51.0.1.0 and earlier contains a mechanism for users to recover or change their passwords without knowing the original password, but the user account must be compromised prior to the weak recovery mechanism.
Problem types: cwe_id: CWE-640
description: CWE-640 Weak Password Recovery Mechanism for Forgotten Password
Affected products: vendor: IBM
product: Security SOAR
cpes: cpe:2.3:a:ibm:soar:51.0.1.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-11-14T11:50:02.851Z
CVE-2024-45671 IBM Security Verify Information Queue information disclosure
IBM Security Verify Information Queue 10.0.5, 10.0.6, 10.0.7, and 10.0.8 

uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: IBM
product: Security Verify Information Queue
cpes: cpe:2.3:a:ibm:security_verify_information_queue:10.0.5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.6:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_information_queue:10.0.8:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-09-10T20:08:17.525Z
CVE-2024-45672 IBM Security Verify Bridge data manipulation
IBM Security Verify Bridge 1.0.0 through 1.0.15 could allow a local privileged user to overwrite files due to excessive privileges granted to the agent. which could also cause a denial of service.
Problem types: cwe_id: CWE-471
description: CWE-471 Modification of Assumed-Immutable Data (MAID)
Affected products: vendor: IBM
product: Security Verify Bridge
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2025-01-23T17:31:58.939Z
CVE-2024-45673 IBM Security Verify Bridge information disclosure
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 stores user credentials in configuration files which can be read by a local user.
Problem types: cwe_id: CWE-260
description: CWE-260 Password in Configuration File
Affected products: vendor: IBM
product: Security Verify Bridge Directory Sync
cpes: cpe:2.3:a:ibm:security_verify_bridge:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_bridge:1.0.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-02-21T16:45:51.122Z
CVE-2024-45674 IBM Security Verify Bridge information disclosure
IBM Security Verify Bridge Directory Sync 1.0.1 through 1.0.12, IBM Security Verify Gateway for Windows Login 1.0.1 through 1.0.10, and IBM Security Verify Gateway for Radius 1.0.1 through 1.0.11 

stores potentially sensitive information in log files that could be read by a local user.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: IBM
product: Security Verify Bridge Directory Sync
cpes: cpe:2.3:a:ibm:security_verify_bridge:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_bridge:1.0.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-02-21T23:29:17.020Z
CVE-2024-45675 IBM Informix Dynamic Server Authentication Bypass
IBM Informix Dynamic Server 14.10 could allow a local user on the system to log into the Informix server as administrator without a password.
Problem types: cwe_id: CWE-309
description: CWE-309 Use of Password System for Primary Authentication
Affected products: vendor: IBM
product: Informix Dynamic Server
cpes: cpe:2.3:a:ibm:informix_dynamic_server:14.10:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-12-02T02:00:26.554Z
CVE-2024-45676 IBM Cognos Controller file upload
IBM Cognos Controller 11.0.0 and 11.0.1 







could allow an authenticated user to upload insecure files, due to insufficient file type distinction.
Problem types: cwe_id: CWE-351
description: CWE-351 Insufficient Type Distinction
Affected products: vendor: IBM
product: Cognos Controller
cpes: cpe:2.3:a:ibm:cognos_controller:11.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:cognos_controller:11.0.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2024-12-03T17:08:51.441Z
CVE-2024-45678 
Yubico YubiKey 5 Series devices with firmware before 5.7.0 and YubiHSM 2 devices with firmware before 2.4.0 allow an ECDSA secret-key extraction attack (that requires physical access and expensive equipment) in which an electromagnetic side channel is present because of a non-constant-time modular inversion for the Extended Euclidean Algorithm, aka the EUCLEAK issue. Other uses of an Infineon cryptographic library may also be affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-03T00:00:00.000Z
CVE-2024-45679 
Heap-based buffer overflow vulnerability in Assimp versions prior to 5.4.3 allows a local attacker to execute arbitrary code by importing a specially crafted file into the product.
Problem types: description: Heap-based buffer overflow
Affected products: vendor: Open Asset Import Library
product: Assimp
Published: 2024-09-18T03:35:30.462Z
CVE-2024-45682 Millbeck Communications Proroute H685t-w Command Injection.
There is a command injection vulnerability that may allow an attacker to inject malicious input on the device's operating system.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Millbeck Communications
product: Proroute H685t-w
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Joe Lovett from Pen Test Partners reported these vulnerabilities to CISA.
Published: 2024-09-17T17:13:18.655Z
CVE-2024-45687 HTTP Server incorrectly accepting disallowed characters within header values
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in Payara Platform Payara Server (Grizzly, REST Management Interface modules), Payara Platform Payara Micro (Grizzly modules) allows Manipulating State, Identity Spoofing.This issue affects Payara Server: from 4.1.151 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0; Payara Micro: from 4.1.152 through 4.1.2.191.51, from 5.20.0 through 5.70.0, from 5.2020.2 through 5.2022.5, from 6.2022.1 through 6.2024.12, from 6.0.0 through 6.21.0.
Problem types: cwe_id: CWE-113
description: CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Affected products: vendor: Payara Platform
product: Payara Server
default_status: unaffected
vendor: Payara Platform
product: Payara Micro
default_status: unaffected
Credits: lang: en
value: Ben Kallus
Published: 2025-01-21T16:35:43.932Z
CVE-2024-45689 Moodle: unprotected access to sensitive information via dynamic tables
A flaw was found in Moodle. Dynamic tables did not enforce capability checks, which resulted in users having the ability to retrieve information they did not have permission to access.
Affected products: default_status: unaffected
Published: 2024-11-20T10:22:48.635Z
CVE-2024-45690 Moodle: idor when deleting oauth2 linked accounts
A flaw was found in Moodle. Additional checks were required to ensure users can only delete their OAuth2-linked accounts.
Affected products: default_status: unaffected
Published: 2024-11-20T10:23:38.420Z
CVE-2024-45691 Moodle: lesson activity password bypass through php loose comparison
A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values.
Affected products: default_status: unaffected
Published: 2024-11-20T10:25:30.380Z
CVE-2024-45692 
Webmin before 2.202 and Virtualmin before 7.20.2 allow a network traffic loop via spoofed UDP packets on port 10000.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-04T00:00:00.000Z
CVE-2024-45693 Apache CloudStack: Request origin validation bypass makes account takeover possible
Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account takeover, disruption, exposure of sensitive data and compromise integrity of the resources owned by the user account that are managed by the platform.

This issue affects Apache CloudStack from 4.15.1.0 through 4.18.2.3 and 4.19.0.0 through 4.19.1.1



Users are recommended to upgrade to Apache CloudStack 4.18.2.4 or 4.19.1.2, or later, which addresses this issue.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Apache Software Foundation
product: Apache CloudStack
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Arthur Souza
lang: en
value: Felipe Olivaes
Published: 2024-10-16T07:52:25.816Z
CVE-2024-45694 D-Link WiFi router - Stack-based Buffer Overflow
The web service of certain models of D-Link wireless routers contains a Stack-based Buffer Overflow vulnerability, which allows unauthenticated remote attackers to exploit this vulnerability to execute arbitrary code on the device.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: D-Link
product: DIR-X5460 A1
default_status: unaffected
vendor: D-Link
product: DIR-X4860 A1
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-09-16T06:33:25.812Z