rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-45613 CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package
CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, leading to unauthorized JavaScript code execution, if the attacker managed to insert a malicious content into the editor, which might happen with a very specific editor configuration. This vulnerability only affects installations where the Block Toolbar plugin is enabled and either the General HTML Support (with a configuration that permits unsafe markup) or the HTML Embed plugin is also enabled. A fix for the problem is available in version 43.1.1. As a workaround, one may disable the block toolbar plugin.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ckeditor
product: ckeditor5
Published: 2024-09-25T13:27:03.546Z
CVE-2024-45614 Header normalization allows for client to clobber proxy set headers in Puma
Puma is a Ruby/Rack web server built for parallelism. In affected versions clients could clobber values set by intermediate proxies (such as X-Forwarded-For) by providing a underscore version of the same header (X-Forwarded_For). Any users relying on proxy set variables is affected. v6.4.3/v5.6.9 now discards any headers using underscores if the non-underscore version also exists. Effectively, allowing the proxy defined headers to always win. Users are advised to upgrade. Nginx has a underscores_in_headers configuration variable to discard these headers at the proxy level as a mitigation. Any users that are implicitly trusting the proxy defined headers for security should immediately cease doing so until upgraded to the fixed versions.
Problem types: cwe_id: CWE-639
description: CWE-639: Authorization Bypass Through User-Controlled Key
Affected products: vendor: puma
product: puma
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
version: 3.1
Published: 2024-09-19T22:42:33.974Z
CVE-2024-45615 Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. 
The problem is missing  initialization of variables expected to be initialized (as arguments to other functions, etc.).
Problem types: cwe_id: CWE-457
description: Use of Uninitialized Variable
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:19:51.000Z
CVE-2024-45616 Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

The following problems were caused by insufficient control of the response APDU buffer and its length when communicating with the card.
Problem types: cwe_id: CWE-457
description: Use of Uninitialized Variable
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:20:22.459Z
CVE-2024-45617 Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
Problem types: cwe_id: CWE-457
description: Use of Uninitialized Variable
Affected products: default_status: unaffected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:20:53.782Z
CVE-2024-45618 Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init
A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. 

Insufficient or missing checking of return values of functions leads to unexpected work with variables that have not been initialized.
Problem types: cwe_id: CWE-457
description: Use of Uninitialized Variable
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:21:25.869Z
CVE-2024-45619 Libopensc: incorrect handling length of buffers or files in libopensc
A vulnerability was found in OpenSC, OpenSC tools, PKCS#11 module, minidriver, and CTK. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
Problem types: cwe_id: CWE-120
description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:21:39.080Z
CVE-2024-45620 Libopensc: incorrect handling of the length of buffers or files in pkcs15init
A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. When buffers are partially filled with data, initialized parts of the buffer can be incorrectly accessed.
Problem types: cwe_id: CWE-120
description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 10
cpes: cpe:/o:redhat:enterprise_linux:10
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 7
cpes: cpe:/o:redhat:enterprise_linux:7
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 8
cpes: cpe:/o:redhat:enterprise_linux:8
default_status: affected
vendor: Red Hat
product: Red Hat Enterprise Linux 9
cpes: cpe:/o:redhat:enterprise_linux:9
default_status: affected
CVSS v3.1: attackComplexity: HIGH
attackVector: PHYSICAL
availabilityImpact: LOW
baseScore: 3.9
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Matteo Marini (Sapienza University of Rome) for reporting this issue.
Published: 2024-09-03T21:21:57.892Z
CVE-2024-45621 
The Electron desktop application of Rocket.Chat through 6.3.4 allows stored XSS via links in an uploaded file, related to failure to use a separate browser upon encountering third-party external actions from PDF documents.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-02T00:00:00.000Z
CVE-2024-45622 
ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-02T00:00:00.000Z
CVE-2024-45623 
D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handles PHP HTTP GET requests for the Apache HTTP Server (httpd). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-09-02T00:00:00.000Z
CVE-2024-45624 
Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved.
Problem types: description: Exposure of Sensitive Information Due to Incompatible Policies
Affected products: vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
vendor: PgPool Global Development Group
product: Pgpool-II
Published: 2024-09-12T04:33:40.437Z
CVE-2024-45625 
Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.
Problem types: description: Cross-site scripting (XSS)
Affected products: vendor: WPMU DEV
product: Forminator
Published: 2024-09-09T04:44:54.663Z
CVE-2024-45626 Apache James: denial of service through JMAP HTML to text conversion
Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service.

Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Apache Software Foundation
product: Apache James server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Benoit TELLIER
lang: en
value: Wojciech Kapcia
Published: 2025-02-06T11:21:12.417Z
CVE-2024-45627 Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability
In Apache Linkis <1.7.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will 

allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis < 1.7.0 will be affected. 
We recommend users upgrade the version of Linkis to version 1.7.0.
Problem types: cwe_id: CWE-552
description: CWE-552 Files or Directories Accessible to External Parties
Affected products: vendor: Apache Software Foundation
product: Apache Linkis Metadata Query Service JDBC
default_status: unaffected
Credits: lang: en
value: Le1a
Published: 2025-01-14T16:13:20.135Z
CVE-2024-45638 IBM QRadar EDR information disclosure
IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.
Problem types: cwe_id: CWE-256
description: CWE-256 Plaintext Storage of a Password
Affected products: vendor: IBM
product: QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-03-14T14:49:52.646Z
CVE-2024-45640 IBM Security QRadar EDR information disclosure
IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system.
Problem types: cwe_id: CWE-497
description: CWE-497 Exposure of Sensitive System Information to an Unauthorized Control Sphere
Affected products: vendor: IBM
product: Security QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-01-07T12:22:04.843Z
CVE-2024-45641 IBM Security ReaQta improper certificate validation
IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: vendor: IBM
product: Security ReaQta EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Published: 2025-05-20T15:27:45.402Z
CVE-2024-45642 IBM Security ReaQta information disclosure
IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-942
description: CWE-942 Overly Permissive Cross-domain Whitelist
Affected products: vendor: IBM
product: Security ReaQta
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2024-11-14T12:04:31.126Z
CVE-2024-45643 IBM QRadar EDR information disclosure
IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credential information.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: IBM
product: QRadar EDR
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-03-14T14:49:01.428Z
CVE-2024-45644 IBM Security ReaQta file upload
IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: IBM
product: Security ReaQta
cpes: cpe:2.3:a:ibm:security_qradar_edr:3.12:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-03-19T11:16:42.624Z
CVE-2024-45647 IBM Security Verify Access unverified password change
IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.
Problem types: cwe_id: CWE-620
description: CWE-620 Unverified Password Change
Affected products: vendor: IBM
product: Security Verify Access
cpes: cpe:2.3:a:ibm:security_verify_access:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access:10.0.8:*:*:*:*:*:*:*
default_status: unaffected
vendor: IBM
product: Security Verify Access Docker
cpes: cpe:2.3:a:ibm:security_verify_access_docker:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_access_docker:10.0.8:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-01-20T14:50:54.184Z
CVE-2024-45650 IBM Security Verify Directory denial of service
IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: IBM
product: Security Verify Directory
cpes: cpe:2.3:a:ibm:security_verify_directory:10.0.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:security_verify_directory:10.0.3:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2025-01-31T15:07:24.198Z
CVE-2024-45651 IBM Sterling Connect:Direct Web Services session fixation
IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 

does not invalidate session after a browser closure which could allow an authenticated user to impersonate another user on the system.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Sterling Connect:Direct Web Services
cpes: cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:windows:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:unix:*:*
cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:unix:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2025-04-18T11:04:55.508Z