rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-52861 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:04:51.292Z
CVE-2024-52862 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:04:57.079Z
CVE-2024-52864 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:04:28.945Z
CVE-2024-52865 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.
Problem types: cwe_id: CWE-79
description: Cross-site Scripting (Stored XSS) (CWE-79)
Affected products: vendor: Adobe
product: Adobe Experience Manager
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
availabilityRequirement: NOT_DEFINED
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
confidentialityRequirement: NOT_DEFINED
environmentalScore: 5.4
environmentalSeverity: MEDIUM
exploitCodeMaturity: NOT_DEFINED
integrityImpact: LOW
integrityRequirement: NOT_DEFINED
modifiedAttackComplexity: LOW
modifiedAttackVector: NETWORK
modifiedAvailabilityImpact: NONE
modifiedConfidentialityImpact: LOW
modifiedIntegrityImpact: LOW
modifiedPrivilegesRequired: LOW
modifiedScope: CHANGED
modifiedUserInteraction: REQUIRED
privilegesRequired: LOW
remediationLevel: NOT_DEFINED
reportConfidence: NOT_DEFINED
scope: CHANGED
temporalScore: 5.4
temporalSeverity: MEDIUM
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-12-10T22:05:04.425Z
CVE-2024-52867 
guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata concerns (e.g., for setuid and setgid programs) are properly addressed. The vulnerability can be remediated within the product via certain pull, reconfigure, and restart actions. Both 5ab3c4c and 5582241 are needed to resolve the vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:L/A:H/C:H/I:H/PR:N/S:C/UI:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
Published: 2024-11-17T00:00:00.000Z
CVE-2024-52869 
Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. Specifically, when there is an operating system move from SUSE Enterprise Linux Server (SLES) 12 Service Pack (SP) 2 or 3 to SLES 15 SP2 on Teradata Database systems, some service/system user accounts, and possibly systems administrator created user accounts, are incorrectly assigned to groups that allow higher system-level privileges than intended for those user accounts. Depending on the usage of these accounts, this may lead to full system compromise.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-08T00:00:00.000Z
CVE-2024-52870 
Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (including Chromium Developer Tools) that can result in a client user accessing arbitrary remote websites.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-01-17T00:00:00.000Z
CVE-2024-52871 
In Flagsmith before 2.134.1, it is possible to bypass the ALLOW_REGISTRATION_WITHOUT_INVITE setting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-17T00:00:00.000Z
CVE-2024-52872 
In Flagsmith before 2.134.1, the get_document endpoint is not correctly protected by permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-17T00:00:00.000Z
CVE-2024-52874 
In Infoblox NETMRI before 7.6.1, authenticated users can perform SQL injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-22T00:00:00.000Z
CVE-2024-52875 
An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response. This can be exploited to perform Open Redirect or HTTP Response Splitting attacks, which in turn lead to Reflected Cross-Site Scripting (XSS). Remote command execution can be achieved by leveraging the upgrade feature in the admin interface.
Problem types: cwe_id: CWE-113
description: CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
Affected products: vendor: GFI
product: Kerio Control
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 8.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: 2025-01-31T00:00:00.000Z
CVE-2024-52876 
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-17T00:00:00.000Z
CVE-2024-52877 
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, callback function SmmCreateVariableLockList () calls CreateVariableLockListInSmm (). In CreateVariableLockListInSmm (), it uses StrSize () to get variable name size and it could lead to a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2024-52878 
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, VariableServicesSetVariable () can be called by gRT_>SetVariable () or the SmmSetSensitiveVariable () or SmmInternalSetVariable () from SMM. In VariableServicesSetVariable (), it uses StrSize () to get variable name size, uses StrLen () to get variable name length and uses StrCmp () to compare strings. These actions may cause a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2024-52879 
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SmmUpdateVariablePropertySmi () is a SMM callback function and it uses StrCmp () to compare variable names. This action may cause a buffer over-read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2024-52880 
An issue was discovered in Insyde InsydeH2O kernel 5.2 before version 05.29.50, kernel 5.3 before version 05.38.50, kernel 5.4 before version 05.46.50, kernel 5.5 before version 05.54.50, kernel 5.6 before version 05.61.50, and kernel 5.7 before version 05.70.50. In VariableRuntimeDxe driver, SecureBootHandler uses DataSize and VariableNameSize when determining if the data or name are in the buffer, but these are supplied by the caller and therefore cannot be trusted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-05-15T00:00:00.000Z
CVE-2024-52881 
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to the use of a hard-coded key, an attacker is able to decrypt sensitive data such as passwords extracted from the topology file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-52882 
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code (XSS) to attack logged-in administrator sessions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-52883 
An issue was discovered in AudioCodes One Voice Operations Center (OVOC) before 8.4.582. Due to a path traversal vulnerability, sensitive data can be read without any authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-52884 
An issue was discovered in AudioCodes Mediant Session Border Controller (SBC) before 7.40A.501.841. Due to the use of weak password obfuscation/encryption, an attacker with access to configuration exports (INI) is able to decrypt the passwords.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-07T00:00:00.000Z
CVE-2024-52885 Path Traversal
The Mobile Access Portal's File Share application is vulnerable to a directory traversal attack, allowing an authenticated, malicious end-user (authorized to at least one File Share application) to list the file names of 'nobody'-accessible directories on the Mobile Access gateway.
Problem types: cwe_id: CWE-35
description: CWE-35: Path Traversal
Affected products: vendor: checkpoint
product: Check Point Mobile Access
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Published: 2025-08-06T14:45:43.182Z
CVE-2024-52887 Self-XSS
Authenticated end-user may set a specially crafted SNX bookmark that can make their browser run a script while accessing their own bookmark list.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Affected products: vendor: checkpoint
product: Check Point Mobile Access
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Published: 2025-04-27T07:46:23.027Z
CVE-2024-52888 Stored-XSS
For an authenticated end-user the portal may run a script while attempting to display a directory or some file's properties.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Affected products: vendor: checkpoint
product: Check Point Mobile Access
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published: 2025-04-27T07:46:53.542Z
CVE-2024-52890 IBM Engineering Lifecycle Optimization - Publishing cross-site scripting
IBM Engineering Lifecycle Optimization - Publishing 7.0.2 and 7.03 could be susceptible to cross-site scripting due to no validation of URIs.
Problem types: cwe_id: CWE-84
description: CWE-84
Affected products: vendor: IBM
product: IBM Engineering Lifecycle Optimization - Publishing
cpes: cpe:2.3:a:ibm:engineering_lifecycle_optimization_-_publishing:7.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:engineering_lifecycle_optimization_-_publishing:7.0.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-08-05T13:45:59.104Z
CVE-2024-52891 IBM Concert Software log manipulation
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 

could allow an authenticated user to inject malicious information or obtain information from log files due to improper log neutralization.
Problem types: cwe_id: CWE-117
description: CWE-117 Improper Output Neutralization for Logs
Affected products: vendor: IBM
product: Concert Software
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-01-07T11:58:13.671Z
CVE-2024-52892 IBM Jazz for Service Management Cross-Site Scripting
IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Jazz for Service Management
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-02-06T19:27:39.422Z
CVE-2024-52893 IBM Concert Software information disclosure
IBM Concert Software 1.0.0, 1.0.1, 1.0.2, 1.0.2.1, and 1.0.3 

could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.
Problem types: cwe_id: CWE-209
description: CWE-209 Generation of Error Message Containing Sensitive Information
Affected products: vendor: IBM
product: Concert Software
cpes: cpe:2.3:a:ibm:concert:1.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.2.1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:concert:1.0.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-07T12:00:41.835Z
CVE-2024-52894 IBM Db2 for Linux, UNIX and Windows denial of service
IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.2 is vulnerable to a denial of service as the server may crash under certain conditions with a specially crafted query.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: IBM
product: Db2
cpes: cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:10.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:10.5.11:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.1.4.7:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:11.5.9:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.0:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.1:*:*:*:*:zos:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:linux:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:aix:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:db2:12.1.2:*:*:*:*:zos:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-07-29T19:00:12.910Z
CVE-2024-52895 IBM i denial of service
IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the database.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: IBM
product: i
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-02-14T14:36:21.990Z