rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-51366 
An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploading a crafted .conf file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-51367 
An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitrary code via uploading a crafted .xml file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-21T00:00:00.000Z
CVE-2024-51376 
Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFile.action?path= component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2024-51377 
An issue in Ladybird Web Solution Faveo Helpdesk & Servicedesk (On-Premise and Cloud) 9.2.0 allows a remote attacker to execute arbitrary code via the Subject and Identifier fields
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51378 
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
Published: 2024-10-29T00:00:00.000Z
CVE-2024-51379 
Stored Cross-Site Scripting (XSS) vulnerability discovered in JATOS v3.9.3. The vulnerability exists in the description component of the study section, where an attacker can inject JavaScript into the description field. This allows for the execution of malicious scripts when an admin views the description, potentially leading to account takeover and unauthorized actions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-51380 
Stored Cross-Site Scripting (XSS) vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaScript into the properties section of a study, specifically within the UUID field. When an admin user accesses the study's properties, the injected script is executed in the admin's browser, which could lead to unauthorized actions, including account compromise and privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-51381 
Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin accounts. This critical flaw can lead to unauthorized activities, compromising the security and integrity of the platform, especially if an attacker gains administrative control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-51382 
Cross-Site Request Forgery (CSRF) vulnerability in JATOS v3.9.3 allows an attacker to reset the administrator's password. This critical security flaw can result in unauthorized access to the platform, enabling attackers to hijack admin accounts and compromise the integrity and security of the system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-05T00:00:00.000Z
CVE-2024-51392 
An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-29T00:00:00.000Z
CVE-2024-51394 
Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_MSP::loop, AP_MSP, AP_MSP.cpp components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2024-51395 
Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a denial of service via the AP_SmartAudio::loop, AP_SmartAudio, AP_SmartAudio.cpp components.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-13T00:00:00.000Z
CVE-2024-51398 
Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthorized access, data theft, and network attacks, seriously threatening network security.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51399 
Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtain sensitive information such as user credentials, system configuration, and database connection strings, which can lead to data breaches and identity theft.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51406 
Floodlight SDN Open Flow Controller v.1.2 has an issue that allows local hosts to build fake LLDP packets that allow specific clusters to be missed by Floodlight, which in turn leads to missed hosts inside and outside the cluster.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51407 
Floodlight SDN OpenFlow Controller v.1.2 has an issue that allows local hosts to construct false broadcast ports causing inter-host communication anomalies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51408 
AppSmith Community 1.8.3 before 1.46 allows SSRF via New DataSource for application/json requests to 169.254.169.254 to retrieve AWS metadata credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.5
baseSeverity: HIGH
Published: 2024-11-04T00:00:00.000Z
CVE-2024-51409 
Buffer Overflow vulnerability in Tenda O3 v.1.0.0.5 allows a remote attacker to cause a denial of service via a network packet in a fixed format to a router running the corresponding version of the firmware.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-06T00:00:00.000Z
CVE-2024-51417 
An issue in System.Linq.Dynamic.Core before 1.6.0 allows remote access to properties on reflection types and static properties/fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-21T00:00:00.000Z
CVE-2024-51419 
Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a remote attacker to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-51423 
Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-09-02T00:00:00.000Z
CVE-2024-51424 
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the Owned.setOwner function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-51425 
An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. NOTE: this is disputed by third parties because the impact is limited to function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-51426 
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the _transfer function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-51427 
An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact via the mint function. NOTE: this is disputed by third parties because the impact is limited to function calls.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-30T00:00:00.000Z
CVE-2024-51428 
An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2024-51430 
Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary code via the Test Name parameter on the diagnostic/add-test.php component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-10-31T00:00:00.000Z
CVE-2024-51431 
LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51432 
Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI Clients List not being sanitized
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-01T00:00:00.000Z
CVE-2024-51434 
Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-07T00:00:00.000Z
CVE-2024-51440 
An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-12T00:00:00.000Z
CVE-2024-51442 
Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna.conf configuration file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-08T00:00:00.000Z
CVE-2024-51444 
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The application insufficiently validates user input for database read queries. This could allow an authenticated remote attacker to conduct an SQL injection attack that bypasses authorization controls and allows to download any data from the application's database.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Siemens
product: Polarion V2310
default_status: unknown
vendor: Siemens
product: Polarion V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-05-13T09:38:21.392Z
CVE-2024-51445 
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The affected application contains a XML External Entity Injection (XXE) vulnerability in the docx import feature. This could allow an authenticated remote attacker to read arbitrary data from the application server.
Problem types: cwe_id: CWE-611
description: CWE-611: Improper Restriction of XML External Entity Reference
Affected products: vendor: Siemens
product: Polarion V2310
default_status: unknown
vendor: Siemens
product: Polarion V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-05-13T09:38:22.679Z
CVE-2024-51446 
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: Polarion V2310
default_status: unknown
vendor: Siemens
product: Polarion V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2025-05-13T09:38:24.164Z
CVE-2024-51447 
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.2). The login implementation of the affected application contains an observable response discrepancy vulnerability when validating usernames. This could allow an unauthenticated remote attacker to distinguish between valid and invalid usernames.
Problem types: cwe_id: CWE-204
description: CWE-204: Observable Response Discrepancy
Affected products: vendor: Siemens
product: Polarion V2310
default_status: unknown
vendor: Siemens
product: Polarion V2404
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2025-05-13T09:38:25.452Z
CVE-2024-51448 IBM Robotic Process Automation privilege escalation
IBM Robotic Process Automation 21.0.0 through 21.0.7.17 and 23.0.0 through 23.0.18 could allow a local user to escalate their privileges. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service. A subsequent service or server restart will then run that binary with administrator privilege.
Problem types: cwe_id: CWE-277
description: CWE-277 Insecure Inherited Permissions
Affected products: vendor: IBM
product: Robotic Process Automation
cpes: cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:21.0.7.17:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.18:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-01-18T15:08:42.484Z
CVE-2024-51450 IBM Security Verify Directory Command Execution
IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: IBM
product: Security Verify Directory
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-02-06T00:15:03.488Z
CVE-2024-51451 Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0.0 through 2.1.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
Problem types: cwe_id: CWE-644
description: CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
Affected products: vendor: IBM
product: Concert
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:2.1.0:*:*:*:*:*:*:*
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2026-02-04T21:21:44.544Z
CVE-2024-51453 IBM Sterling Secure Proxy directory traversal
IBM Sterling Secure Proxy 6.2.0.0 through 6.2.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: IBM
product: Sterling Secure Proxy
cpes: cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:sterling_secure_proxy:6.2.0.1:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-05-28T15:22:39.745Z
CVE-2024-51456 IBM Robotic Process Automation information disclosure
IBM Robotic Process Automation 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 could allow a remote attacker to obtain sensitive data that may be exposed through certain crypto-analytic attacks.
Problem types: cwe_id: CWE-780
description: CWE-780 Use of RSA Algorithm without OAEP
Affected products: vendor: IBM
product: Robotic Process Automation
cpes: cpe:2.3:a:ibm:robotic_process_automation:21.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-01-12T13:26:34.770Z
CVE-2024-51457 IBM Robotic Process Automation for Cloud Pak cross-site scripting
IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Robotic Process Automation for Cloud Pak
cpes: cpe:2.3:a:ibm:robotic_process_automation:21.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:21.0.7.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:robotic_process_automation:23.0.19:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-01-22T16:36:54.641Z
CVE-2024-51459 IBM InfoSphere Server Information command execution
IBM InfoSphere Information Server 11.7 could allow a local user to execute privileged commands due to the improper handling of permissions.
Problem types: cwe_id: CWE-280
description: CWE-280 Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-03-19T18:08:06.215Z
CVE-2024-51460 IBM InfoSphere Information Server information disclosure
IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: InfoSphere Information Server
cpes: cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-12-11T12:15:49.427Z
CVE-2024-51461 IBM QRadar WinCollect Agent denial of service
IBM QRadar WinCollect Agent 10.0 through 10.1.13 could allow a remote attacker to cause a denial of service by interrupting an HTTP request that could consume memory resources.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: QRadar WinCollect Agent
cpes: cpe:2.3:a:ibm:qradar_wincollect:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:qradar_wincollect:10.1.13:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-04-11T01:13:57.207Z