CVE-2024-56493

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56494

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56495

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56496

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56810

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56811

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-56812

IBM EntireX information disclosure

IBM EntireX 11.1 could allow a local user to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-54169

IBM EntireX path traversal

IBM EntireX 11.1 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-54170

IBM EntireX denial of service

IBM EntireX 11.1 could allow a local user to cause a denial of service due to use of a regular expression with an inefficient complexity that consumes excessive CPU cycles.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-54171

IBM EntireX XML external entity injection

IBM EntireX 11.1 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. An authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ibm Linux Microsoft

Products

Entirex Linux Kernel Windows

CVE-2024-31879

IBM i denial of service

IBM i 7.2, 7.3, and 7.4 could allow a remote attacker to execute arbitrary code leading to a denial of service of network ports on the system, caused by the deserialization of untrusted data. IBM X-Force ID: 287539.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2024-47104

IBM i incorrect privilege assignment

IBM i 7.4 and 7.5 is vulnerable to an authenticated user gaining elevated privilege to a physical file. A user with authority to a view can alter the based-on physical file security attributes without having object management rights to the physical file. A malicious actor can use the elevated privileges to perform actions restricted by their view privileges.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2024-52895

IBM i denial of service

IBM i 7.4 and 7.5 is vulnerable to a database access denial of service caused by a bypass of a database capabilities restriction check. A privileged bad actor can remove or otherwise impact database infrastructure files resulting in incorrect behavior of software products that rely upon the database.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2024-55898

IBM i privilege escalation

IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

I

CVE-2024-40702

IBM Cognos Controller improper certificate validation

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain access to protected resources due to improper certificate validation.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Cognos Controller Controller Windows

CVE-2024-28778

IBM Cognos Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 is vulnerable to exposure of Artifactory API keys. This vulnerability allows users to publish code to private packages or repositories under the name of the organization.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Cognos Controller Controller Windows

CVE-2024-25037

IBM Cognos Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Cognos Controller Controller Windows

CVE-2022-22363

IBM Cognos Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Cognos Controller Controller Windows

CVE-2021-20455

IBM Cognos Controller information disclosure

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Microsoft

Products

Cognos Controller Controller Windows

CVE-2024-25048

IBM MQ code execution

IBM MQ Appliance 9.3 CD and LTS are vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system or cause the server to crash. IBM X-Force ID: 283137.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Mq Appliance