Directory traversal

Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbitrary code via the formatlogfile.pl file...

Remote code execution

Nteract v.0.28.0 was discovered to contain a remote code execution RCE vulnerability via the Markdown link...

Code injection

IBM WebSphere Application Server Liberty 17.0.0.3 through 24.0.0.2 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274711...

Design/Logic Flaw

IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 261115...

Design/Logic Flaw

IBM CP4BA - Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a user to gain the privileges of another user under unusual circumstances. IBM X-Force ID: 271656...

CVE-2023-50312

CVE-2023-50312 affects IBM WebSphere Application Server Liberty. The issue is that outbound TLS connections could have weaker-than-expected security due to a failure to honor user configuration. Affected versions are Liberty 17.0.0.3 through 24.0.0.2. The connected documents reiterate the same de...

CVE-2023-38366

The CVE-2023-38366 issue affects IBM Filenet Content Manager Component versions 5.5.8.0, 5.5.10.0, and 5.5.11.0 (and related X-Force/Red Hat entries) where a remote attacker could traverse directories by sending a crafted URL containing dot-dot sequences (/../). Impact is restricted to directory ...

CVE-2023-47716

CVE-2023-47716 affects IBM FileNet Content Manager components in CP4BA/Filenet Content Manager: versions 5.5.8.0, 5.5.10.0, and 5.5.11.0 (also CP4BA 21.0.3 and 23.0.1). The issue “could allow a user to gain the privileges of another user under unusual circumstances.” The IBM bulletin and related ...

Cross site scripting

IBM Engineering Requirements Management 9.7.2.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Design/Logic Flaw

IBM Engineering Requirements Management DOORS 9.7.2.7 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 273336...

Cross site request forgery (csrf)

IBM Engineering Requirements Management DOORS 9.7.2.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 251216...

CVE-2023-50324

The vulnerability CVE-2023-50324 affects IBM Cognos Command Center 10.2.4.1 and 10.2.5, where the X-AspNet-Version HTTP response header exposes environment details that could aid further attacks. This is a information-disclosure issue, not remote code execution. Root cause is exposure of server h...

CVE-2023-50305

CVE-2023-50305 affects IBM Engineering Requirements Management DOORS family (DOORS 9.7.2.7; DOORS Web Access 9.7.2.7; Rational DOORS/DOORS Web Access 9.6.1.x). According to the IBM bulletin, the issue is a design/logic flaw where users by default do not have strong passwords, enabling easier comp...

CVE-2023-28525

CVE-2023-28525 affects IBM Engineering Requirements Management DOORS/DOORS Web Access 9.7.2.7 with a cross-site scripting vulnerability in the Web UI that could allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. IBM recommends ...

CVE-2024-25578

CVE-2024-25578 affects MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and earlier, due to a lack of proper validation of user-supplied data that could lead to memory corruption. The ICS/CISA advisory lists an Out-of-Bounds Write vulnerability (CWE-787) with a CVSS v3.1 base score of 7.8 (lo...

CVE-2024-22100

CVE-2024-22100 affects MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior. The vulnerability is a heap-based buffer overflow in the viewer when processing a malicious DCM file, enabling arbitrary code execution after user opens the file (local attack surface; UI interaction required)....

Session fixation

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...

Server side request forgery (ssrf)

Recipes version 1.5.10 allows arbitrary HTTP requests to be made through the server. This is possible because the application is vulnerable to SSRF...

CVE-2024-2022

Netentsec NS-ASG Application Security Gateway 6.3 is affected by a SQL injection in /admin/list_ipAddressPolicy.php triggered by manipulating the GroupId parameter. The vulnerability can be exploited remotely; an exploit has been publicly disclosed. There is no explicit patched version in the pro...

CVE-2024-24511

CVE-2024-24511 affects PKP OPEN JOURNAL SYSTEMS (PKP OJS) v3.4, with a Cross Site Scripting vulnerability in the Input Title component that could allow an attacker to execute arbitrary code. The public sources consistently cite PKP OJS 3.4 as vulnerable and describe the issue as a stored XSS vect...