rainbutterfly/cve_corpus huggingface dataset:
CVE-2024-38279 Authentication Bypass Using an Alternate Path or Channel in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
The affected product is vulnerable to an attacker modifying the bootloader by using custom arguments to bypass authentication and gain access to the file system and obtain password hashes.
Problem types: cwe_id: CWE-288
description: CWE-288 Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:00:20.515Z
CVE-2024-38280 Cleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
An unauthorized user is able to gain access to sensitive data, including credentials, by physically retrieving the hard disk of the product as the data is stored in clear text.
Problem types: cwe_id: CWE-313
description: CWE-313: Cleartext Storage in a File or on Disk
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:05:58.531Z
CVE-2024-38281 Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
An attacker can access the maintenance console using hard coded credentials for a hidden wireless network on the device.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:10:36.156Z
CVE-2024-38282 Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Utilizing default credentials, an attacker is able to log into the camera's operating system which could allow changes to be made to the operations or shutdown the camera requiring a physical reboot of the system.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:13:39.781Z
CVE-2024-38283 Missing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Sensitive customer information is stored in the device without encryption.
Problem types: cwe_id: CWE-311
description: CWE-311 Missing Encryption of Sensitive Data
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:17:43.694Z
CVE-2024-38284 Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Transmitted data is logged between the device and the backend service. An attacker could use these logs to perform a replay attack to replicate calls.
Problem types: cwe_id: CWE-294
description: CWE-294 Authentication Bypass by Capture-replay
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:22:10.318Z
CVE-2024-38285 Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
Logs storing credentials are insufficiently protected and can be decoded through the use of open source tools.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Motorola Solutions
product: Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
default_status: unaffected
Credits: lang: en
value: The Michigan State Police Michigan Cyber Command Center (MC3)
Published: 2024-06-13T17:26:46.091Z
CVE-2024-38286 Apache Tomcat: Denial of Service
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89.


The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109. Other EOL versions may also be affected.


Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.



Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: Apache Software Foundation
product: Apache Tomcat
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.6
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Ozaki, North Grid Corporation
Published: 2024-11-07T07:37:32.224Z
CVE-2024-38287 
The password-reset mechanism in the Forgot Password functionality in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to force the application into resetting the administrator's password to a random insecure 8-digit value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-38288 
A command-injection issue in the Certificate Signing Request (CSR) functionality in R-HUB TurboMeeting through 8.x allows authenticated attackers with administrator privileges to execute arbitrary commands on the underlying server as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-38289 
A boolean-based SQL injection issue in the Virtual Meeting Password (VMP) endpoint in R-HUB TurboMeeting through 8.x allows unauthenticated remote attackers to extract hashed passwords from the database, and authenticate to the application, via crafted SQL input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-07-25T00:00:00.000Z
CVE-2024-38290 
In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-38291 
In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-38292 
In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege escalation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-02-27T00:00:00.000Z
CVE-2024-38293 
ALCASAR before 3.6.1 allows CSRF and remote code execution in activity.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-38294 
ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-38295 
ALCASAR before 3.6.1 allows still_connected.php remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-06-13T00:00:00.000Z
CVE-2024-38296 
Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain an Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
Problem types: cwe_id: CWE-1421
description: CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
Affected products: vendor: Dell
product: Edge Gateway 5200
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank the Eclypsium Research Team for reporting this issue
Published: 2024-11-22T02:58:27.660Z
CVE-2024-38301 
Dell Alienware Command Center, version 5.7.3.0 and prior, contains an improper access control vulnerability. A low privileged attacker could potentially exploit this vulnerability, leading to denial of service on the local system and information disclosure.
Problem types: cwe_id: CWE-1107
description: CWE-1107: Insufficient Isolation of Symbolic Constant Definitions
Affected products: vendor: Dell
product: Alienware Command Center (AWCC)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-07-10T02:12:54.987Z
CVE-2024-38302 
Dell Data Lakehouse, version(s) 1.0.0.0, contain(s) a Missing Encryption of Sensitive Data vulnerability in the DDAE (Starburst). A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.
Problem types: cwe_id: CWE-311
description: CWE-311: Missing Encryption of Sensitive Data
Affected products: vendor: Dell
product: Dell Data Lakehouse
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Published: 2024-07-18T15:51:54.140Z
CVE-2024-38303 
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20: Improper Input Validation
Affected products: vendor: Dell
product: PowerEdge Platform
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell would like to thank codebreaker1337 for reporting this issue.
Published: 2024-08-29T04:34:53.178Z
CVE-2024-38304 
Dell PowerEdge Platform, 14G Intel BIOS version(s) prior to 2.22.x, contains an Access of Memory Location After End of Buffer vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
Problem types: cwe_id: CWE-788
description: CWE-788: Access of Memory Location After End of Buffer
Affected products: vendor: Dell
product: PowerEdge Platform
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.8
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Dell would like to thank codebreaker1337 for reporting this issue.
Published: 2024-08-29T08:03:40.261Z
CVE-2024-38305 
Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.
Problem types: cwe_id: CWE-426
description: CWE-426: Untrusted Search Path
Affected products: vendor: Dell
product: SupportAssist for Home PCs
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Dell would like to thank Shaurya1337 and sahilshah3276 for reporting this issue.
Published: 2024-08-21T01:54:46.614Z
CVE-2024-38307 
Improper input validation in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow an authenticated user to potentially enable denial of service via network access.
Problem types: description: Denial of Service
cwe_id: CWE-20
description: Improper Input Validation
Affected products: vendor: n/a
product: Intel(R) AMT and Intel(R) Standard Manageability
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 7.7
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
Published: 2025-02-12T21:19:19.293Z
CVE-2024-38308 Advantech ADAM-5550 Cross-site Scripting
Advantech ADAM 5550's web application includes a "logs" page where all 
the HTTP requests received are displayed to the user. The device doesn't
 correctly neutralize malicious code when parsing HTTP requests to 
generate page output.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting
Affected products: vendor: Advantech
product: ADAM 5550
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Aarón Flecha Menéndez and Luis Villalba Pérez of S21sec reported these vulnerabilities to CISA.
Published: 2024-09-27T17:28:34.284Z
CVE-2024-38309 
There are multiple stack-based buffer overflow vulnerabilities in V-SFT (v6.2.2.0 and earlier), TELLUS (v4.0.19.0 and earlier), and TELLUS Lite (v4.0.19.0 and earlier).
If a user opens a specially crafted file, information may be disclosed and/or arbitrary code may be executed.
Problem types: cwe_id: CWE-121
description: Stack-based buffer overflow
Affected products: vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: V-SFT
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS
vendor: FUJI ELECTRIC CO., LTD. and Hakko Electronics Co., Ltd.
product: TELLUS Lite
Published: 2024-11-28T02:10:32.213Z
CVE-2024-38310 
Improper access control in some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: Escalation of Privilege
cwe_id: CWE-284
description: Improper Access Control
Affected products: vendor: n/a
product: Intel(R) Graphics Driver software installers
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2025-02-12T21:18:48.842Z
CVE-2024-38311 Apache Traffic Server: Request smuggling via pipelining after a chunked message body
Improper Input Validation vulnerability in Apache Traffic Server.

This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.8, from 10.0.0 through 10.0.3.

Users are recommended to upgrade to version 9.2.9 or 10.0.4, which fixes the issue.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
default_status: unaffected
Credits: lang: en
value: Ben Kallus
Published: 2025-03-06T11:34:16.289Z
CVE-2024-38312 
When browsing private tabs, some data related to location history or webpage thumbnails could be persisted incorrectly within the sandboxed app bundle after app termination This vulnerability affects Firefox for iOS < 127.
Problem types: description: Private tabs could result in residual data related to browsing history in app bundle
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Adam Berry
Published: 2024-06-13T20:01:13.543Z
CVE-2024-38313 
In certain scenarios a malicious website could attempt to display a fake location URL bar which could mislead users as to the actual website address This vulnerability affects Firefox for iOS < 127.
Problem types: description: Location URL bar could be visually spoofed with a fake toolbar
Affected products: vendor: Mozilla
product: Firefox for iOS
Credits: lang: en
value: Muneaki Nishimura
Published: 2024-06-13T20:01:13.281Z
CVE-2024-38314 IBM Maximo Application Suite - Monitor Component information disclosure
IBM Maximo Application Suite - Monitor Component 8.10, 8.11, and 9.0 could disclose information in the form of the hard-coded cryptographic key to an attacker that has compromised environment.
Problem types: cwe_id: CWE-321
description: CWE-321 Use of Hard-coded Cryptographic Key
Affected products: vendor: IBM
product: Maximo Application Suite - Monitor Component
cpes: cpe:2.3:a:ibm:maximo_application_suite:8.10:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:8.11:*:*:*:*:*:*:*
cpe:2.3:a:ibm:maximo_application_suite:9.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-10-24T17:23:06.127Z
CVE-2024-38315 IBM Aspera Shares session fixation
IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: IBM
product: Aspera Shares
cpes: cpe:2.3:a:ibm:aspera_shares:1.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:aspera_shares:1.10.0:patch_level2:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-09-16T15:05:49.347Z
CVE-2024-38316 IBM Aspera Shares Denial of Service
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: IBM
product: Aspera Shares
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Published: 2025-02-05T22:30:35.881Z
CVE-2024-38317 IBM Aspera Shares Cross-Site Scripting
IBM Aspera Shares 1.9.0 through 1.10.0 PL6  is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: IBM
product: Aspera Shares
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-02-05T22:43:49.501Z
CVE-2024-38318 IBM Aspera Shares HTML injection
IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
Problem types: cwe_id: CWE-80
description: CWE-80
Affected products: vendor: IBM
product: Aspera Shares
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Published: 2025-02-05T22:49:18.237Z
CVE-2024-38319 IBM Security SOAR code execution
IBM Security SOAR 51.0.2.0 could allow an authenticated user to execute malicious code loaded from a specially crafted script.  IBM X-Force ID:  294830.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: IBM
product: Security SOAR
cpes: cpe:2.3:a:ibm:soar:51.0.2.0:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Julien Champoux
Published: 2024-06-22T18:56:34.854Z