-
Notifications
You must be signed in to change notification settings - Fork 212
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- 2 new CVEs: CVE-2024-45652, CVE-2024-45653 - 0 updated CVEs:
- Loading branch information
cvelistV5 Github Action
committed
Jan 19, 2025
1 parent
609aeea
commit b816f4b
Showing
4 changed files
with
242 additions
and
20 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,103 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-45652", | ||
| "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "ibm", | ||
| "dateReserved": "2024-09-03T13:50:26.296Z", | ||
| "datePublished": "2025-01-19T02:42:18.748Z", | ||
| "dateUpdated": "2025-01-19T02:42:18.748Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "cpes": [ | ||
| "cpe:2.3:a:ibm:maximo_asset_management:7.6.1.3:*:*:*:*:*:*:*" | ||
| ], | ||
| "defaultStatus": "unaffected", | ||
| "product": "Maximo Asset Management", | ||
| "vendor": "IBM", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "7.6.1.3" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system." | ||
| } | ||
| ], | ||
| "value": "IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing \"dot dot\" sequences (/../) to view arbitrary files on the system." | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 6.5, | ||
| "baseSeverity": "MEDIUM", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "NONE", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-22", | ||
| "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", | ||
| "shortName": "ibm", | ||
| "dateUpdated": "2025-01-19T02:42:18.748Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "tags": [ | ||
| "vendor-advisory" | ||
| ], | ||
| "url": "https://www.ibm.com/support/pages/node/7174820" | ||
| } | ||
| ], | ||
| "source": { | ||
| "discovery": "UNKNOWN" | ||
| }, | ||
| "title": "IBM Maximo Asset Management directory traversal", | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| { | ||
| "dataType": "CVE_RECORD", | ||
| "dataVersion": "5.1", | ||
| "cveMetadata": { | ||
| "cveId": "CVE-2024-45653", | ||
| "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", | ||
| "state": "PUBLISHED", | ||
| "assignerShortName": "ibm", | ||
| "dateReserved": "2024-09-03T13:50:26.296Z", | ||
| "datePublished": "2025-01-19T02:39:30.681Z", | ||
| "dateUpdated": "2025-01-19T02:39:30.681Z" | ||
| }, | ||
| "containers": { | ||
| "cna": { | ||
| "affected": [ | ||
| { | ||
| "cpes": [ | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.0.0.0:*:*:*:*:windows:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:windows:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:windows:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:windows:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.0.0.0:*:*:*:*:unix:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.1.0.0:*:*:*:*:unix:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.2.0.0:*:*:*:*:unix:*:*", | ||
| "cpe:2.3:a:ibm:sterling_connect_direct_web_services:6.3.0.0:*:*:*:*:unix:*:*" | ||
| ], | ||
| "defaultStatus": "unaffected", | ||
| "product": "Sterling Connect:Direct Web Services", | ||
| "vendor": "IBM", | ||
| "versions": [ | ||
| { | ||
| "status": "affected", | ||
| "version": "6.0, 6.1, 6.2, 6.3" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "supportingMedia": [ | ||
| { | ||
| "base64": false, | ||
| "type": "text/html", | ||
| "value": "IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system." | ||
| } | ||
| ], | ||
| "value": "IBM Sterling Connect:Direct Web Services 6.0, 6.1, 6.2, and 6.3 could disclose sensitive IP address information to authenticated users in responses that could be used in further attacks against the system." | ||
| } | ||
| ], | ||
| "metrics": [ | ||
| { | ||
| "cvssV3_1": { | ||
| "attackComplexity": "LOW", | ||
| "attackVector": "NETWORK", | ||
| "availabilityImpact": "NONE", | ||
| "baseScore": 4.3, | ||
| "baseSeverity": "MEDIUM", | ||
| "confidentialityImpact": "LOW", | ||
| "integrityImpact": "NONE", | ||
| "privilegesRequired": "LOW", | ||
| "scope": "UNCHANGED", | ||
| "userInteraction": "NONE", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", | ||
| "version": "3.1" | ||
| }, | ||
| "format": "CVSS", | ||
| "scenarios": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "GENERAL" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "problemTypes": [ | ||
| { | ||
| "descriptions": [ | ||
| { | ||
| "cweId": "CWE-201", | ||
| "description": "CWE-201 Insertion of Sensitive Information Into Sent Data", | ||
| "lang": "en", | ||
| "type": "CWE" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "providerMetadata": { | ||
| "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", | ||
| "shortName": "ibm", | ||
| "dateUpdated": "2025-01-19T02:39:30.681Z" | ||
| }, | ||
| "references": [ | ||
| { | ||
| "url": "https://www.ibm.com/support/pages/node/7174104" | ||
| } | ||
| ], | ||
| "source": { | ||
| "discovery": "UNKNOWN" | ||
| }, | ||
| "title": "IBM Sterling Connect:Direct Web Services information disclosure", | ||
| "x_generator": { | ||
| "engine": "Vulnogram 0.2.0" | ||
| } | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters