Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-6531 (GCVE-0-2024-6531)
Vulnerability from cvelistv5
This was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Show details on NVD website{ "containers": { "cna": { "providerMetadata": { "dateUpdated": "2025-08-01T17:12:55.431Z", "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs" }, "rejectedReasons": [ { "lang": "en", "supportingMedia": [ { "base64": false, "type": "text/html", "value": "This was not a security issue in Bootstrap. Bootstrap\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\u2019s security model, and the associated CVE has been rescinded." } ], "value": "This was not a security issue in Bootstrap. Bootstrap\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\u2019s security model, and the associated CVE has been rescinded." } ], "x_generator": { "engine": "Vulnogram 0.1.0-dev" } } }, "cveMetadata": { "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "assignerShortName": "HeroDevs", "cveId": "CVE-2024-6531", "datePublished": "2024-07-11T17:15:57.820Z", "dateRejected": "2025-08-01T17:12:55.431Z", "dateReserved": "2024-07-05T13:56:42.257Z", "dateUpdated": "2025-08-01T17:12:55.431Z", "state": "REJECTED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2024-6531\",\"sourceIdentifier\":\"36c7be3b-2937-45df-85ea-ca7133ea542c\",\"published\":\"2024-07-11T18:15:06.207\",\"lastModified\":\"2025-08-01T18:15:31.217\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This was not a security issue in Bootstrap. Bootstrap\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\u2019s security model, and the associated CVE has been rescinded.\"}],\"metrics\":{},\"references\":[]}}", "vulnrichment": { "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"shortName\": \"HeroDevs\", \"dateUpdated\": \"2025-08-01T17:12:55.431Z\"}, \"rejectedReasons\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"This was not a security issue in Bootstrap. Bootstrap\\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\\u2019s security model, and the associated CVE has been rescinded.\"}], \"value\": \"This was not a security issue in Bootstrap. Bootstrap\\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\\u2019s security model, and the associated CVE has been rescinded.\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2024-6531\", \"assignerOrgId\": \"36c7be3b-2937-45df-85ea-ca7133ea542c\", \"state\": \"REJECTED\", \"assignerShortName\": \"HeroDevs\", \"dateReserved\": \"2024-07-05T13:56:42.257Z\", \"datePublished\": \"2024-07-11T17:15:57.820Z\", \"dateUpdated\": \"2025-08-01T17:12:55.431Z\", \"dateRejected\": \"2025-08-01T17:12:55.431Z\"}", "dataType": "CVE_RECORD", "dataVersion": "5.1" } } }
CERTFR-2025-AVI-0337
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Vendor | Product | Description | ||
---|---|---|---|---|
IBM | Sterling | Sterling Connect:Direct Web Services versions 6.1.x antérieures à 6.1.0.28 | ||
IBM | QRadar | QRadar Suite Software versions 1.1x.x.x antérieures à 1.11.2.x | ||
IBM | Cloud Pak | Cloud Pak for Security versions 1.1x.x.x antérieures à 1.11.2.x | ||
IBM | QRadar | SOAR QRadar Plugin App versions antérieures à 5.6.0 |
Title | Publication Time | Tags | |||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Sterling Connect:Direct Web Services versions 6.1.x ant\u00e9rieures \u00e0 6.1.0.28", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "QRadar Suite Software versions 1.1x.x.x ant\u00e9rieures \u00e0 1.11.2.x", "product": { "name": "QRadar", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Cloud Pak for Security versions 1.1x.x.x ant\u00e9rieures \u00e0 1.11.2.x", "product": { "name": "Cloud Pak", "vendor": { "name": "IBM", "scada": false } } }, { "description": "SOAR QRadar Plugin App versions ant\u00e9rieures \u00e0 5.6.0", "product": { "name": "QRadar", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": "", "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).", "cves": [ { "name": "CVE-2024-42459", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42459" }, { "name": "CVE-2024-21235", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21235" }, { "name": "CVE-2024-6531", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6531" }, { "name": "CVE-2024-22201", "url": "https://www.cve.org/CVERecord?id=CVE-2024-22201" }, { "name": "CVE-2023-1370", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1370" }, { "name": "CVE-2024-55565", "url": "https://www.cve.org/CVERecord?id=CVE-2024-55565" }, { "name": "CVE-2024-43788", "url": "https://www.cve.org/CVERecord?id=CVE-2024-43788" }, { "name": "CVE-2024-4068", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4068" }, { "name": "CVE-2020-35494", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35494" }, { "name": "CVE-2020-15250", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15250" }, { "name": "CVE-2024-23944", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23944" }, { "name": "CVE-2024-12797", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12797" }, { "name": "CVE-2024-43799", "url": "https://www.cve.org/CVERecord?id=CVE-2024-43799" }, { "name": "CVE-2024-21068", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21068" }, { "name": "CVE-2020-35496", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35496" }, { "name": "CVE-2024-21534", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21534" }, { "name": "CVE-2024-42460", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42460" }, { "name": "CVE-2024-56326", "url": "https://www.cve.org/CVERecord?id=CVE-2024-56326" }, { "name": "CVE-2024-45813", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45813" }, { "name": "CVE-2025-24970", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970" }, { "name": "CVE-2023-45133", "url": "https://www.cve.org/CVERecord?id=CVE-2023-45133" }, { "name": "CVE-2025-21613", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21613" }, { "name": "CVE-2024-12798", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12798" }, { "name": "CVE-2023-25584", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25584" }, { "name": "CVE-2024-43796", "url": "https://www.cve.org/CVERecord?id=CVE-2024-43796" }, { "name": "CVE-2025-22866", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22866" }, { "name": "CVE-2024-4067", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4067" }, { "name": "CVE-2024-29018", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29018" }, { "name": "CVE-2024-8184", "url": "https://www.cve.org/CVERecord?id=CVE-2024-8184" }, { "name": "CVE-2025-1302", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1302" }, { "name": "CVE-2025-27152", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27152" }, { "name": "CVE-2024-21538", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21538" }, { "name": "CVE-2024-45336", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45336" }, { "name": "CVE-2024-48948", "url": "https://www.cve.org/CVERecord?id=CVE-2024-48948" }, { "name": "CVE-2024-0450", "url": "https://www.cve.org/CVERecord?id=CVE-2024-0450" }, { "name": "CVE-2024-12801", "url": "https://www.cve.org/CVERecord?id=CVE-2024-12801" }, { "name": "CVE-2018-18700", "url": "https://www.cve.org/CVERecord?id=CVE-2018-18700" }, { "name": "CVE-2024-47554", "url": "https://www.cve.org/CVERecord?id=CVE-2024-47554" }, { "name": "CVE-2024-45296", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45296" }, { "name": "CVE-2024-6763", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6763" }, { "name": "CVE-2024-45337", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45337" }, { "name": "CVE-2024-7254", "url": "https://www.cve.org/CVERecord?id=CVE-2024-7254" }, { "name": "CVE-2019-16163", "url": "https://www.cve.org/CVERecord?id=CVE-2019-16163" }, { "name": "CVE-2024-56201", "url": "https://www.cve.org/CVERecord?id=CVE-2024-56201" }, { "name": "CVE-2023-51775", "url": "https://www.cve.org/CVERecord?id=CVE-2023-51775" }, { "name": "CVE-2024-52798", "url": "https://www.cve.org/CVERecord?id=CVE-2024-52798" }, { "name": "CVE-2024-47535", "url": "https://www.cve.org/CVERecord?id=CVE-2024-47535" }, { "name": "CVE-2023-52428", "url": "https://www.cve.org/CVERecord?id=CVE-2023-52428" }, { "name": "CVE-2024-10041", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10041" }, { "name": "CVE-2023-1972", "url": "https://www.cve.org/CVERecord?id=CVE-2023-1972" }, { "name": "CVE-2025-26791", "url": "https://www.cve.org/CVERecord?id=CVE-2025-26791" }, { "name": "CVE-2024-10963", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10963" }, { "name": "CVE-2024-6119", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6119" }, { "name": "CVE-2023-25588", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25588" }, { "name": "CVE-2025-25193", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25193" }, { "name": "CVE-2020-35495", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35495" }, { "name": "CVE-2025-27789", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27789" }, { "name": "CVE-2024-42461", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42461" }, { "name": "CVE-2024-29180", "url": "https://www.cve.org/CVERecord?id=CVE-2024-29180" }, { "name": "CVE-2019-12972", "url": "https://www.cve.org/CVERecord?id=CVE-2019-12972" }, { "name": "CVE-2025-1094", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1094" }, { "name": "CVE-2023-25585", "url": "https://www.cve.org/CVERecord?id=CVE-2023-25585" }, { "name": "CVE-2025-21614", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21614" }, { "name": "CVE-2025-21502", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21502" }, { "name": "CVE-2020-35507", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35507" }, { "name": "CVE-2020-35493", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35493" }, { "name": "CVE-2024-21217", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21217" }, { "name": "CVE-2018-12699", "url": "https://www.cve.org/CVERecord?id=CVE-2018-12699" }, { "name": "CVE-2024-57699", "url": "https://www.cve.org/CVERecord?id=CVE-2024-57699" } ], "initial_release_date": "2025-04-18T00:00:00", "last_revision_date": "2025-04-18T00:00:00", "links": [], "reference": "CERTFR-2025-AVI-0337", "revisions": [ { "description": "Version initiale", "revision_date": "2025-04-18T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Injection de code indirecte \u00e0 distance (XSS)" }, { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" }, { "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)" }, { "description": "Injection SQL (SQLi)" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": "2025-04-11", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7230739", "url": "https://www.ibm.com/support/pages/node/7230739" }, { "published_at": "2025-04-17", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7231169", "url": "https://www.ibm.com/support/pages/node/7231169" }, { "published_at": "2025-04-16", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7231051", "url": "https://www.ibm.com/support/pages/node/7231051" } ] }
CERTFR-2025-AVI-0746
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un déni de service à distance.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Vendor | Product | Description | ||
---|---|---|---|---|
IBM | Cognos Dashboards | Cognos Command Center versions 10.2.4.1 et 10.2.5 antérieures à 10.2.5 FP1 IF1 | ||
IBM | Sterling | Sterling Secure Proxy versions 6.1.0.x antérieures à 6.1.0.2 GA | ||
IBM | QRadar | QRadar SIEM versions 7.5.0 antérieures à QRadar 7.5.0 UP13 IF01 | ||
IBM | Sterling | Sterling Connect:Direct pour Microsoft Windows versions 6.4.x antérieures à 6.4.0.3 | ||
IBM | WebSphere | WebSphere Remote Server versions 9.1, 8.0 et 8.5 sans le dernier correctif de sécurité | ||
IBM | Cognos Dashboards | Cognos Dashboards on Cloud Pak for Data versions 5.x antérieures à 5.2.1 | ||
IBM | Sterling | Sterling Secure Proxy versions 6.2.0.x antérieures à 6.2.0.2 GA | ||
IBM | QRadar | QRadar Incident Forensics versions 7.5.0 antérieures à QIF 7.5.0 UP13 IF01 | ||
IBM | Sterling | Sterling External Authentication Server versions 6.1.0.x antérieures à 6.1.0.3 GA | ||
IBM | Sterling | Sterling Connect:Direct pour Microsoft Windows versions 6.3.x antérieures à 6.3.0.6 | ||
IBM | Db2 | Db2 Bridge versions antérieures à 1.1.1 |
Title | Publication Time | Tags | |||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Cognos Command Center versions 10.2.4.1 et 10.2.5 ant\u00e9rieures \u00e0 10.2.5 FP1 IF1", "product": { "name": "Cognos Dashboards", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Sterling Secure Proxy versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.2 GA", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "QRadar SIEM versions 7.5.0 ant\u00e9rieures \u00e0 QRadar 7.5.0 UP13 IF01", "product": { "name": "QRadar", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Sterling Connect:Direct pour Microsoft Windows versions 6.4.x ant\u00e9rieures \u00e0 6.4.0.3", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "WebSphere Remote Server versions 9.1, 8.0 et 8.5 sans le dernier correctif de s\u00e9curit\u00e9", "product": { "name": "WebSphere", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Cognos Dashboards on Cloud Pak for Data versions 5.x ant\u00e9rieures \u00e0 5.2.1", "product": { "name": "Cognos Dashboards", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Sterling Secure Proxy versions 6.2.0.x ant\u00e9rieures \u00e0 6.2.0.2 GA", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "QRadar Incident Forensics versions 7.5.0 ant\u00e9rieures \u00e0 QIF 7.5.0 UP13 IF01", "product": { "name": "QRadar", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Sterling External Authentication Server versions 6.1.0.x ant\u00e9rieures \u00e0 6.1.0.3 GA", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Sterling Connect:Direct pour Microsoft Windows versions 6.3.x ant\u00e9rieures \u00e0 6.3.0.6", "product": { "name": "Sterling", "vendor": { "name": "IBM", "scada": false } } }, { "description": "Db2 Bridge versions ant\u00e9rieures \u00e0 1.1.1", "product": { "name": "Db2", "vendor": { "name": "IBM", "scada": false } } } ], "affected_systems_content": "", "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).", "cves": [ { "name": "CVE-2024-6531", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6531" }, { "name": "CVE-2025-4447", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4447" }, { "name": "CVE-2024-21144", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21144" }, { "name": "CVE-2025-24789", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24789" }, { "name": "CVE-2022-50020", "url": "https://www.cve.org/CVERecord?id=CVE-2022-50020" }, { "name": "CVE-2025-47944", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47944" }, { "name": "CVE-2024-50349", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50349" }, { "name": "CVE-2025-46835", "url": "https://www.cve.org/CVERecord?id=CVE-2025-46835" }, { "name": "CVE-2024-57980", "url": "https://www.cve.org/CVERecord?id=CVE-2024-57980" }, { "name": "CVE-2024-43420", "url": "https://www.cve.org/CVERecord?id=CVE-2024-43420" }, { "name": "CVE-2025-49794", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49794" }, { "name": "CVE-2025-22004", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22004" }, { "name": "CVE-2025-27614", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27614" }, { "name": "CVE-2022-49111", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49111" }, { "name": "CVE-2025-1470", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1470" }, { "name": "CVE-2022-49058", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49058" }, { "name": "CVE-2025-24970", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24970" }, { "name": "CVE-2024-52006", "url": "https://www.cve.org/CVERecord?id=CVE-2024-52006" }, { "name": "CVE-2025-4373", "url": "https://www.cve.org/CVERecord?id=CVE-2025-4373" }, { "name": "CVE-2024-13009", "url": "https://www.cve.org/CVERecord?id=CVE-2024-13009" }, { "name": "CVE-2025-50106", "url": "https://www.cve.org/CVERecord?id=CVE-2025-50106" }, { "name": "CVE-2025-48385", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48385" }, { "name": "CVE-2025-48060", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48060" }, { "name": "CVE-2024-50154", "url": "https://www.cve.org/CVERecord?id=CVE-2024-50154" }, { "name": "CVE-2025-27613", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27613" }, { "name": "CVE-2025-30754", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30754" }, { "name": "CVE-2024-10917", "url": "https://www.cve.org/CVERecord?id=CVE-2024-10917" }, { "name": "CVE-2022-49136", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49136" }, { "name": "CVE-2025-6965", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6965" }, { "name": "CVE-2022-49846", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49846" }, { "name": "CVE-2019-17543", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17543" }, { "name": "CVE-2025-38086", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38086" }, { "name": "CVE-2025-48384", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48384" }, { "name": "CVE-2025-7783", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7783" }, { "name": "CVE-2025-27152", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27152" }, { "name": "CVE-2025-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1471" }, { "name": "CVE-2025-38079", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38079" }, { "name": "CVE-2025-20012", "url": "https://www.cve.org/CVERecord?id=CVE-2025-20012" }, { "name": "CVE-2025-7425", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7425" }, { "name": "CVE-2025-37738", "url": "https://www.cve.org/CVERecord?id=CVE-2025-37738" }, { "name": "CVE-2024-53920", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53920" }, { "name": "CVE-2025-48976", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48976" }, { "name": "CVE-2025-21587", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21587" }, { "name": "CVE-2025-52520", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52520" }, { "name": "CVE-2024-52533", "url": "https://www.cve.org/CVERecord?id=CVE-2024-52533" }, { "name": "CVE-2024-28956", "url": "https://www.cve.org/CVERecord?id=CVE-2024-28956" }, { "name": "CVE-2025-2697", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2697" }, { "name": "CVE-2025-47935", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47935" }, { "name": "CVE-2025-50059", "url": "https://www.cve.org/CVERecord?id=CVE-2025-50059" }, { "name": "CVE-2025-21928", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21928" }, { "name": "CVE-2025-30761", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30761" }, { "name": "CVE-2024-47535", "url": "https://www.cve.org/CVERecord?id=CVE-2024-47535" }, { "name": "CVE-2025-1494", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1494" }, { "name": "CVE-2025-1994", "url": "https://www.cve.org/CVERecord?id=CVE-2025-1994" }, { "name": "CVE-2025-52434", "url": "https://www.cve.org/CVERecord?id=CVE-2025-52434" }, { "name": "CVE-2025-24495", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24495" }, { "name": "CVE-2025-30698", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30698" }, { "name": "CVE-2022-49977", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49977" }, { "name": "CVE-2024-54661", "url": "https://www.cve.org/CVERecord?id=CVE-2024-54661" }, { "name": "CVE-2025-37890", "url": "https://www.cve.org/CVERecord?id=CVE-2025-37890" }, { "name": "CVE-2025-22020", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22020" }, { "name": "CVE-2025-27533", "url": "https://www.cve.org/CVERecord?id=CVE-2025-27533" }, { "name": "CVE-2025-6021", "url": "https://www.cve.org/CVERecord?id=CVE-2025-6021" }, { "name": "CVE-2025-55668", "url": "https://www.cve.org/CVERecord?id=CVE-2025-55668" }, { "name": "CVE-2025-25193", "url": "https://www.cve.org/CVERecord?id=CVE-2025-25193" }, { "name": "CVE-2024-58002", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58002" }, { "name": "CVE-2025-32415", "url": "https://www.cve.org/CVERecord?id=CVE-2025-32415" }, { "name": "CVE-2025-21905", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21905" }, { "name": "CVE-2024-23337", "url": "https://www.cve.org/CVERecord?id=CVE-2024-23337" }, { "name": "CVE-2025-30749", "url": "https://www.cve.org/CVERecord?id=CVE-2025-30749" }, { "name": "CVE-2025-38052", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38052" }, { "name": "CVE-2025-2900", "url": "https://www.cve.org/CVERecord?id=CVE-2025-2900" }, { "name": "CVE-2025-53506", "url": "https://www.cve.org/CVERecord?id=CVE-2025-53506" }, { "name": "CVE-2019-5427", "url": "https://www.cve.org/CVERecord?id=CVE-2019-5427" }, { "name": "CVE-2022-49788", "url": "https://www.cve.org/CVERecord?id=CVE-2022-49788" }, { "name": "CVE-2025-20623", "url": "https://www.cve.org/CVERecord?id=CVE-2025-20623" }, { "name": "CVE-2025-48997", "url": "https://www.cve.org/CVERecord?id=CVE-2025-48997" }, { "name": "CVE-2020-5260", "url": "https://www.cve.org/CVERecord?id=CVE-2020-5260" }, { "name": "CVE-2025-49796", "url": "https://www.cve.org/CVERecord?id=CVE-2025-49796" }, { "name": "CVE-2025-21919", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21919" }, { "name": "CVE-2024-21131", "url": "https://www.cve.org/CVERecord?id=CVE-2024-21131" }, { "name": "CVE-2024-34397", "url": "https://www.cve.org/CVERecord?id=CVE-2024-34397" }, { "name": "CVE-2025-21991", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21991" }, { "name": "CVE-2025-7338", "url": "https://www.cve.org/CVERecord?id=CVE-2025-7338" }, { "name": "CVE-2025-24790", "url": "https://www.cve.org/CVERecord?id=CVE-2025-24790" }, { "name": "CVE-2024-45332", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45332" }, { "name": "CVE-2025-47273", "url": "https://www.cve.org/CVERecord?id=CVE-2025-47273" }, { "name": "CVE-2025-23150", "url": "https://www.cve.org/CVERecord?id=CVE-2025-23150" } ], "initial_release_date": "2025-08-29T00:00:00", "last_revision_date": "2025-08-29T00:00:00", "links": [], "reference": "CERTFR-2025-AVI-0746", "revisions": [ { "description": "Version initiale", "revision_date": "2025-08-29T00:00:00.000000" } ], "risks": [ { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur" }, { "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits IBM. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et un d\u00e9ni de service \u00e0 distance.", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits IBM", "vendor_advisories": [ { "published_at": "2025-08-28", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243411", "url": "https://www.ibm.com/support/pages/node/7243411" }, { "published_at": "2025-08-22", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7242915", "url": "https://www.ibm.com/support/pages/node/7242915" }, { "published_at": "2025-08-28", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243372", "url": "https://www.ibm.com/support/pages/node/7243372" }, { "published_at": "2025-08-26", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7242159", "url": "https://www.ibm.com/support/pages/node/7242159" }, { "published_at": "2025-08-26", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243146", "url": "https://www.ibm.com/support/pages/node/7243146" }, { "published_at": "2025-08-28", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7242161", "url": "https://www.ibm.com/support/pages/node/7242161" }, { "published_at": "2025-08-26", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243144", "url": "https://www.ibm.com/support/pages/node/7243144" }, { "published_at": "2025-08-25", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243011", "url": "https://www.ibm.com/support/pages/node/7243011" }, { "published_at": "2025-08-28", "title": "Bulletin de s\u00e9curit\u00e9 IBM 7243373", "url": "https://www.ibm.com/support/pages/node/7243373" } ] }
CERTFR-2024-AVI-1061
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Splunk. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Vendor | Product | Description | ||
---|---|---|---|---|
Splunk | Universal Forwarder | Splunk Universal Forwarders versions 9.1.x antérieures à 9.1.7 | ||
Splunk | Universal Forwarder | Splunk Universal Forwarders versions 9.2.x antérieures à 9.2.4 | ||
Splunk | Universal Forwarder | Splunk Universal Forwarders versions 9.3.x antérieures à 9.3.2 | ||
Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.2.2406.x antérieures à 9.2.2406.107 | ||
Splunk | Splunk Enterprise | Splunk Entreprise versions 9.2.x antérieures à 9.2.4 | ||
Splunk | Splunk Secure Gateway | Splunk Secure Gateway versions 3.8.x antérieures à 3.8.5 | ||
Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.2.2403.x antérieures à 9.2.2403.111 | ||
Splunk | Splunk Enterprise | Splunk Entreprise versions 9.1.x antérieures à 9.1.7 | ||
Splunk | Splunk Enterprise | Splunk Entreprise versions 9.3.x antérieures à 9.3.2 | ||
Splunk | Splunk Secure Gateway | Splunk Secure Gateway versions 3.4.x antérieures à 3.4.262 | ||
Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.3.2408.x antérieures à 9.3.2408.101 | ||
Splunk | Splunk Secure Gateway | Splunk Secure Gateway versions 3.7.x antérieures à 3.7.18 | ||
Splunk | Splunk Cloud Platform | Splunk Cloud Platform versions 9.1.2312.x antérieures à 9.1.2312.206 |
Title | Publication Time | Tags | |||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Splunk Universal Forwarders versions 9.1.x ant\u00e9rieures \u00e0 9.1.7", "product": { "name": "Universal Forwarder", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Universal Forwarders versions 9.2.x ant\u00e9rieures \u00e0 9.2.4", "product": { "name": "Universal Forwarder", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Universal Forwarders versions 9.3.x ant\u00e9rieures \u00e0 9.3.2", "product": { "name": "Universal Forwarder", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Cloud Platform versions 9.2.2406.x ant\u00e9rieures \u00e0 9.2.2406.107", "product": { "name": "Splunk Cloud Platform", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Entreprise versions 9.2.x ant\u00e9rieures \u00e0 9.2.4", "product": { "name": "Splunk Enterprise", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Secure Gateway versions 3.8.x ant\u00e9rieures \u00e0 3.8.5", "product": { "name": "Splunk Secure Gateway", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Cloud Platform versions 9.2.2403.x ant\u00e9rieures \u00e0 9.2.2403.111", "product": { "name": "Splunk Cloud Platform", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Entreprise versions 9.1.x ant\u00e9rieures \u00e0 9.1.7", "product": { "name": "Splunk Enterprise", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Entreprise versions 9.3.x ant\u00e9rieures \u00e0 9.3.2", "product": { "name": "Splunk Enterprise", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Secure Gateway versions 3.4.x ant\u00e9rieures \u00e0 3.4.262", "product": { "name": "Splunk Secure Gateway", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Cloud Platform versions 9.3.2408.x ant\u00e9rieures \u00e0 9.3.2408.101", "product": { "name": "Splunk Cloud Platform", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Secure Gateway versions 3.7.x ant\u00e9rieures \u00e0 3.7.18", "product": { "name": "Splunk Secure Gateway", "vendor": { "name": "Splunk", "scada": false } } }, { "description": "Splunk Cloud Platform versions 9.1.2312.x ant\u00e9rieures \u00e0 9.1.2312.206", "product": { "name": "Splunk Cloud Platform", "vendor": { "name": "Splunk", "scada": false } } } ], "affected_systems_content": "", "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).", "cves": [ { "name": "CVE-2024-42459", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42459" }, { "name": "CVE-2024-6531", "url": "https://www.cve.org/CVERecord?id=CVE-2024-6531" }, { "name": "CVE-2024-53245", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53245" }, { "name": "CVE-2024-42460", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42460" }, { "name": "CVE-2024-26308", "url": "https://www.cve.org/CVERecord?id=CVE-2024-26308" }, { "name": "CVE-2024-4067", "url": "https://www.cve.org/CVERecord?id=CVE-2024-4067" }, { "name": "CVE-2024-5535", "url": "https://www.cve.org/CVERecord?id=CVE-2024-5535" }, { "name": "CVE-2024-53247", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53247" }, { "name": "CVE-2024-45296", "url": "https://www.cve.org/CVERecord?id=CVE-2024-45296" }, { "name": "CVE-2024-25710", "url": "https://www.cve.org/CVERecord?id=CVE-2024-25710" }, { "name": "CVE-2024-53244", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53244" }, { "name": "CVE-2024-53243", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53243" }, { "name": "CVE-2024-36114", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36114" }, { "name": "CVE-2024-42461", "url": "https://www.cve.org/CVERecord?id=CVE-2024-42461" }, { "name": "CVE-2024-36129", "url": "https://www.cve.org/CVERecord?id=CVE-2024-36129" }, { "name": "CVE-2021-44531", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44531" }, { "name": "CVE-2024-53246", "url": "https://www.cve.org/CVERecord?id=CVE-2024-53246" } ], "initial_release_date": "2024-12-11T00:00:00", "last_revision_date": "2024-12-11T00:00:00", "links": [], "reference": "CERTFR-2024-AVI-1061", "revisions": [ { "description": "Version initiale", "revision_date": "2024-12-11T00:00:00.000000" } ], "risks": [ { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Splunk. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Splunk", "vendor_advisories": [ { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1204", "url": "https://advisory.splunk.com/advisories/SVD-2024-1204" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1201", "url": "https://advisory.splunk.com/advisories/SVD-2024-1201" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1203", "url": "https://advisory.splunk.com/advisories/SVD-2024-1203" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1207", "url": "https://advisory.splunk.com/advisories/SVD-2024-1207" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1206", "url": "https://advisory.splunk.com/advisories/SVD-2024-1206" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1205", "url": "https://advisory.splunk.com/advisories/SVD-2024-1205" }, { "published_at": "2024-12-10", "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2024-1202", "url": "https://advisory.splunk.com/advisories/SVD-2024-1202" } ] }
wid-sec-w-2024-3674
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Splunk Enterprise erm\u00f6glicht Monitoring und Analyse von Clickstream-Daten und Kundentransaktionen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um vertrauliche Informationen offenzulegen, Sicherheitsma\u00dfnahmen zu umgehen, beliebigen Code auszuf\u00fchren oder unspezifische Angriffe durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-3674 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3674.json" }, { "category": "self", "summary": "WID-SEC-2024-3674 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3674" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1201 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1201" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1202 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1202" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1203 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1203" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1204 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1204" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1205 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1205" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1206 vom 2024-12-10", "url": "https://advisory.splunk.com/advisories/SVD-2024-1206" }, { "category": "external", "summary": "Splunk Security Advisory SVD-2024-1207 vom 2024-12-10", "url": "https://advisory.splunk.com//advisories/SVD-2024-1207" } ], "source_lang": "en-US", "title": "Splunk Splunk Enterprise: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-12-10T23:00:00.000+00:00", "generator": { "date": "2024-12-11T12:11:56.562+00:00", "engine": { "name": "BSI-WID", "version": "1.3.10" } }, "id": "WID-SEC-W-2024-3674", "initial_release_date": "2024-12-10T23:00:00.000+00:00", "revision_history": [ { "date": "2024-12-10T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c9.3.2", "product": { "name": "Splunk Splunk Enterprise \u003c9.3.2", "product_id": "T039778" } }, { "category": "product_version", "name": "9.3.2", "product": { "name": "Splunk Splunk Enterprise 9.3.2", "product_id": "T039778-fixed", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:9.3.2" } } }, { "category": "product_version_range", "name": "\u003c9.2.4", "product": { "name": "Splunk Splunk Enterprise \u003c9.2.4", "product_id": "T039779" } }, { "category": "product_version", "name": "9.2.4", "product": { "name": "Splunk Splunk Enterprise 9.2.4", "product_id": "T039779-fixed", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:9.2.4" } } }, { "category": "product_version_range", "name": "\u003c9.1.7", "product": { "name": "Splunk Splunk Enterprise \u003c9.1.7", "product_id": "T039780" } }, { "category": "product_version", "name": "9.1.7", "product": { "name": "Splunk Splunk Enterprise 9.1.7", "product_id": "T039780-fixed", "product_identification_helper": { "cpe": "cpe:/a:splunk:splunk:9.1.7" } } } ], "category": "product_name", "name": "Splunk Enterprise" } ], "category": "vendor", "name": "Splunk" } ] }, "vulnerabilities": [ { "cve": "CVE-2021-44531", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2021-44531" }, { "cve": "CVE-2024-25710", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-25710" }, { "cve": "CVE-2024-26308", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-26308" }, { "cve": "CVE-2024-36114", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-36114" }, { "cve": "CVE-2024-36129", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-36129" }, { "cve": "CVE-2024-4067", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-4067" }, { "cve": "CVE-2024-42459", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-42459" }, { "cve": "CVE-2024-42460", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-42460" }, { "cve": "CVE-2024-42461", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-42461" }, { "cve": "CVE-2024-45296", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-45296" }, { "cve": "CVE-2024-5535", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-5535" }, { "cve": "CVE-2024-6531", "notes": [ { "category": "description", "text": "In Splunk Enterprise existieren mehrere Schwachstellen. Diese Fehler existieren in verschiedenen Komponenten von Drittanbietern, wie z.B. Apache Common Compress, Micromatch oder OpenSSL. Ein Angreifer kann diese Schwachstellen ausnutzen, um mehrere Arten von Angriffen auszuf\u00fchren oder nicht spezifizierte Auswirkungen zu verursachen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-6531" }, { "cve": "CVE-2024-53243", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Splunk Splunk Enterprise. Dieser Fehler existiert wegen einer unsachgem\u00e4\u00dfen Zugriffskontrolle in den Endpunkten der Key Value Store (KVstore)-Sammlungen in der Secure Gateway App. Ein entfernter, authentifizierter Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen zu Suchanfragen f\u00fcr Alarme anzuzeigen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-53243" }, { "cve": "CVE-2024-53244", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Splunk Splunk Enterprise. Dieser Fehler existiert wegen der unsachgem\u00e4\u00dfen Handhabung von Berechtigungen im Berichtsendpunkt in der Cloud-Plattform. Indem er einen Benutzer mit h\u00f6heren Rechten dazu bringt, eine Anfrage in seinem Browser zu initiieren, kann ein entfernter, authentifizierter Angreifer diese Schwachstelle ausnutzen, um Sicherheitsvorkehrungen zu umgehen und gespeicherte Suchen mit beliebigen Befehlen auszuf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-53244" }, { "cve": "CVE-2024-53245", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Splunk Splunk Enterprise. Dieser Fehler existiert wegen unsachgem\u00e4\u00dfer Zugriffskontrolle in der Komponente zum Klonen von Dashboards in der Cloud Platform. Ein entfernter authentifizierter Angreifer mit einem Benutzerkonto mit geringen Rechten, das denselben Namen wie eine Rolle mit Lesezugriff auf ein Dashboard hat, kann diese Schwachstelle ausnutzen, um den Dashboard-Namen und die XML-Konfiguration durch Klonen des Dashboards anzuzeigen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-53245" }, { "cve": "CVE-2024-53246", "notes": [ { "category": "description", "text": "Dieser Fehler existiert wegen der unsachgem\u00e4\u00dfen Behandlung von SPL-Befehlen in der Suchverarbeitungskomponente in der Cloud-Plattform. Ein entfernter, anonymer Angreifer kann diese Schwachstelle in Kombination mit anderen Schwachstellen ausnutzen, um Zugang zu sensiblen Informationen zu erhalten. Zur erfolgreichen Ausnutzung ist eine Benutzerinteraktion erforderlich." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-53246" }, { "cve": "CVE-2024-53247", "notes": [ { "category": "description", "text": "Es bestehen mehrere Schwachstellen in Splunk Splunk Enterprise. Dieser Fehler existiert wegen einer unsicheren Deserialisierung von Daten in der jsonpickle Python-Bibliothek, die von der Secure Gateway-Anwendung verwendet wird. Ein entfernter authentifizierter Angreifer kann diese Schwachstelle zur Ausf\u00fchrung von beliebigem Code ausnutzen." } ], "product_status": { "known_affected": [ "T039780", "T039779", "T039778" ] }, "release_date": "2024-12-10T23:00:00.000+00:00", "title": "CVE-2024-53247" } ] }
wid-sec-w-2025-1905
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM QRadar Security Information and Event Management (SIEM) bietet Unterst\u00fctzung bei der Erkennung und Priorisierung von Sicherheitsbedrohungen im Unternehmen.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM Komponenten ausnutzen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuf\u00fchren, um beliebigen Programmcode auszuf\u00fchren, um Sicherheitsvorkehrungen zu umgehen, und um Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2025-1905 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1905.json" }, { "category": "self", "summary": "WID-SEC-2025-1905 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1905" }, { "category": "external", "summary": "IBM Security Bulletin 7243011 vom 2025-08-25", "url": "https://www.ibm.com/support/pages/node/7243011" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14746 vom 2025-08-27", "url": "https://access.redhat.com/errata/RHSA-2025:14746" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:14748 vom 2025-08-27", "url": "https://access.redhat.com/errata/RHSA-2025:14748" } ], "source_lang": "en-US", "title": "IBM QRadar SIEM Komponente: Mehrere Schwachstellen", "tracking": { "current_release_date": "2025-08-27T22:00:00.000+00:00", "generator": { "date": "2025-08-28T05:52:03.530+00:00", "engine": { "name": "BSI-WID", "version": "1.4.0" } }, "id": "WID-SEC-W-2025-1905", "initial_release_date": "2025-08-25T22:00:00.000+00:00", "revision_history": [ { "date": "2025-08-25T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2025-08-27T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c7.5.0 UP13 IF01", "product": { "name": "IBM QRadar SIEM \u003c7.5.0 UP13 IF01", "product_id": "T046492" } }, { "category": "product_version", "name": "7.5.0 UP13 IF01", "product": { "name": "IBM QRadar SIEM 7.5.0 UP13 IF01", "product_id": "T046492-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up13_if01" } } } ], "category": "product_name", "name": "QRadar SIEM" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-17543", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2019-17543" }, { "cve": "CVE-2019-5427", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2019-5427" }, { "cve": "CVE-2020-5260", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2020-5260" }, { "cve": "CVE-2022-49058", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49058" }, { "cve": "CVE-2022-49111", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49111" }, { "cve": "CVE-2022-49136", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49136" }, { "cve": "CVE-2022-49788", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49788" }, { "cve": "CVE-2022-49846", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49846" }, { "cve": "CVE-2022-49977", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-49977" }, { "cve": "CVE-2022-50020", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2022-50020" }, { "cve": "CVE-2024-23337", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-23337" }, { "cve": "CVE-2024-28956", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-28956" }, { "cve": "CVE-2024-34397", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-34397" }, { "cve": "CVE-2024-43420", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-43420" }, { "cve": "CVE-2024-45332", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-45332" }, { "cve": "CVE-2024-50154", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-50154" }, { "cve": "CVE-2024-50349", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-50349" }, { "cve": "CVE-2024-52006", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-52006" }, { "cve": "CVE-2024-52533", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-52533" }, { "cve": "CVE-2024-53920", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-53920" }, { "cve": "CVE-2024-54661", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-54661" }, { "cve": "CVE-2024-57980", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-57980" }, { "cve": "CVE-2024-58002", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-58002" }, { "cve": "CVE-2024-6531", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2024-6531" }, { "cve": "CVE-2025-20012", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-20012" }, { "cve": "CVE-2025-20623", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-20623" }, { "cve": "CVE-2025-21905", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-21905" }, { "cve": "CVE-2025-21919", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-21919" }, { "cve": "CVE-2025-21928", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-21928" }, { "cve": "CVE-2025-21991", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-21991" }, { "cve": "CVE-2025-22004", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-22004" }, { "cve": "CVE-2025-22020", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-22020" }, { "cve": "CVE-2025-23150", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-23150" }, { "cve": "CVE-2025-24495", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-24495" }, { "cve": "CVE-2025-27613", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-27613" }, { "cve": "CVE-2025-27614", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-27614" }, { "cve": "CVE-2025-32415", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-32415" }, { "cve": "CVE-2025-37738", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-37738" }, { "cve": "CVE-2025-37890", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-37890" }, { "cve": "CVE-2025-38052", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-38052" }, { "cve": "CVE-2025-38079", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-38079" }, { "cve": "CVE-2025-38086", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-38086" }, { "cve": "CVE-2025-4373", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-4373" }, { "cve": "CVE-2025-46835", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-46835" }, { "cve": "CVE-2025-47273", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-47273" }, { "cve": "CVE-2025-48060", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-48060" }, { "cve": "CVE-2025-48384", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-48384" }, { "cve": "CVE-2025-48385", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-48385" }, { "cve": "CVE-2025-49794", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-49794" }, { "cve": "CVE-2025-49796", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-49796" }, { "cve": "CVE-2025-52434", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-52434" }, { "cve": "CVE-2025-52520", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-52520" }, { "cve": "CVE-2025-53506", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-53506" }, { "cve": "CVE-2025-55668", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-55668" }, { "cve": "CVE-2025-6021", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-6021" }, { "cve": "CVE-2025-6965", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-6965" }, { "cve": "CVE-2025-7425", "product_status": { "known_affected": [ "67646", "T046492" ] }, "release_date": "2025-08-25T22:00:00.000+00:00", "title": "CVE-2025-7425" } ] }
wid-sec-w-2024-1606
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Bootstrap ist ein HTML-, CSS- und JavaScript-Framework f\u00fcr die Entwicklung responsiver Webprojekte.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1606 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1606.json" }, { "category": "self", "summary": "WID-SEC-2024-1606 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1606" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6531" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6484" }, { "category": "external", "summary": "Camunda Security Notices", "url": "https://docs.camunda.org/security/notices/#notice-124" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:1249 vom 2025-02-10", "url": "https://access.redhat.com/errata/RHSA-2025:1249" }, { "category": "external", "summary": "IBM Security Bulletin 7228842 vom 2025-03-24", "url": "https://www.ibm.com/support/pages/node/7228842" }, { "category": "external", "summary": "IBM Security Bulletin 7229443 vom 2025-03-28", "url": "https://www.ibm.com/support/pages/node/7229443" }, { "category": "external", "summary": "Debian Security Advisory DLA-4124 vom 2025-04-13", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00020.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-4125 vom 2025-04-13", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00021.html" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html" }, { "category": "external", "summary": "IBM Security Bulletin 7243781 vom 2025-09-02", "url": "https://www.ibm.com/support/pages/node/7243781" } ], "source_lang": "en-US", "title": "Bootstrap: Mehrere Schwachstellen erm\u00f6glichen Cross-Site Scripting", "tracking": { "current_release_date": "2025-09-02T22:00:00.000+00:00", "generator": { "date": "2025-09-03T07:32:04.489+00:00", "engine": { "name": "BSI-WID", "version": "1.4.0" } }, "id": "WID-SEC-W-2024-1606", "initial_release_date": "2024-07-11T22:00:00.000+00:00", "revision_history": [ { "date": "2024-07-11T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-12-09T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates aufgenommen" }, { "date": "2025-02-10T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2025-03-23T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-03-30T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-04-13T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2025-05-14T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2025-09-02T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "8" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c11.0.4-00", "product": { "name": "Hitachi Ops Center \u003c11.0.4-00", "product_id": "T043089" } }, { "category": "product_version", "name": "11.0.4-00", "product": { "name": "Hitachi Ops Center 11.0.4-00", "product_id": "T043089-fixed", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:11.0.4-00" } } } ], "category": "product_name", "name": "Ops Center" } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "on Cloud Pak for Data", "product": { "name": "IBM DB2 on Cloud Pak for Data", "product_id": "T042208", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:on_cloud_pak_for_data" } } } ], "category": "product_name", "name": "DB2" }, { "branches": [ { "category": "product_version", "name": "V10", "product": { "name": "IBM Power Hardware Management Console V10", "product_id": "T023373", "product_identification_helper": { "cpe": "cpe:/a:ibm:hardware_management_console:v10" } } } ], "category": "product_name", "name": "Power Hardware Management Console" }, { "branches": [ { "category": "product_version_range", "name": "IP Edition \u003c4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c4.2 Fix Pack 23", "product_id": "T046654" } }, { "category": "product_version", "name": "IP Edition 4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition 4.2 Fix Pack 23", "product_id": "T046654-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition___4.2_fix_pack_23" } } } ], "category": "product_name", "name": "Tivoli Network Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c5", "product": { "name": "Open Source Bootstrap \u003c5", "product_id": "T036126" } }, { "category": "product_version", "name": "5", "product": { "name": "Open Source Bootstrap 5", "product_id": "T036126-fixed", "product_identification_helper": { "cpe": "cpe:/a:getbootstrap:bootstrap:5" } } } ], "category": "product_name", "name": "Bootstrap" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.20.9", "product": { "name": "Open Source Camunda \u003c7.20.9", "product_id": "T039659" } }, { "category": "product_version", "name": "7.20.9", "product": { "name": "Open Source Camunda 7.20.9", "product_id": "T039659-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.20.9" } } }, { "category": "product_version_range", "name": "\u003c7.21.6", "product": { "name": "Open Source Camunda \u003c7.21.6", "product_id": "T039660" } }, { "category": "product_version", "name": "7.21.6", "product": { "name": "Open Source Camunda 7.21.6", "product_id": "T039660-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.21.6" } } }, { "category": "product_version_range", "name": "\u003c7.22.1", "product": { "name": "Open Source Camunda \u003c7.22.1", "product_id": "T039661" } }, { "category": "product_version", "name": "7.22.1", "product": { "name": "Open Source Camunda 7.22.1", "product_id": "T039661-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.22.1" } } }, { "category": "product_version_range", "name": "\u003c7.23.0-alpha2", "product": { "name": "Open Source Camunda \u003c7.23.0-alpha2", "product_id": "T039662" } }, { "category": "product_version", "name": "7.23.0-alpha2", "product": { "name": "Open Source Camunda 7.23.0-alpha2", "product_id": "T039662-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.23.0-alpha2" } } } ], "category": "product_name", "name": "Camunda" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Discovery", "product": { "name": "Red Hat Enterprise Linux Discovery", "product_id": "T040951", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:discovery" } } } ], "category": "product_name", "name": "Enterprise Linux" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-6484", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6484" }, { "cve": "CVE-2024-6485", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6485" }, { "cve": "CVE-2024-6531", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6531" } ] }
WID-SEC-W-2024-1606
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Bootstrap ist ein HTML-, CSS- und JavaScript-Framework f\u00fcr die Entwicklung responsiver Webprojekte.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Bootstrap ausnutzen, um einen Cross-Site Scripting Angriff durchzuf\u00fchren.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2024-1606 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1606.json" }, { "category": "self", "summary": "WID-SEC-2024-1606 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1606" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6531" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6485" }, { "category": "external", "summary": "herodevs vulnerability directory vom 2024-07-11", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6484" }, { "category": "external", "summary": "Camunda Security Notices", "url": "https://docs.camunda.org/security/notices/#notice-124" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2025:1249 vom 2025-02-10", "url": "https://access.redhat.com/errata/RHSA-2025:1249" }, { "category": "external", "summary": "IBM Security Bulletin 7228842 vom 2025-03-24", "url": "https://www.ibm.com/support/pages/node/7228842" }, { "category": "external", "summary": "IBM Security Bulletin 7229443 vom 2025-03-28", "url": "https://www.ibm.com/support/pages/node/7229443" }, { "category": "external", "summary": "Debian Security Advisory DLA-4124 vom 2025-04-13", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00020.html" }, { "category": "external", "summary": "Debian Security Advisory DLA-4125 vom 2025-04-13", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00021.html" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2025-113 vom 2025-05-15", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2025-113/index.html" }, { "category": "external", "summary": "IBM Security Bulletin 7243781 vom 2025-09-02", "url": "https://www.ibm.com/support/pages/node/7243781" } ], "source_lang": "en-US", "title": "Bootstrap: Mehrere Schwachstellen erm\u00f6glichen Cross-Site Scripting", "tracking": { "current_release_date": "2025-09-02T22:00:00.000+00:00", "generator": { "date": "2025-09-03T07:32:04.489+00:00", "engine": { "name": "BSI-WID", "version": "1.4.0" } }, "id": "WID-SEC-W-2024-1606", "initial_release_date": "2024-07-11T22:00:00.000+00:00", "revision_history": [ { "date": "2024-07-11T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2024-12-09T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates aufgenommen" }, { "date": "2025-02-10T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2025-03-23T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-03-30T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2025-04-13T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von Debian aufgenommen" }, { "date": "2025-05-14T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2025-09-02T22:00:00.000+00:00", "number": "8", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "8" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c11.0.4-00", "product": { "name": "Hitachi Ops Center \u003c11.0.4-00", "product_id": "T043089" } }, { "category": "product_version", "name": "11.0.4-00", "product": { "name": "Hitachi Ops Center 11.0.4-00", "product_id": "T043089-fixed", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:11.0.4-00" } } } ], "category": "product_name", "name": "Ops Center" } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "on Cloud Pak for Data", "product": { "name": "IBM DB2 on Cloud Pak for Data", "product_id": "T042208", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:on_cloud_pak_for_data" } } } ], "category": "product_name", "name": "DB2" }, { "branches": [ { "category": "product_version", "name": "V10", "product": { "name": "IBM Power Hardware Management Console V10", "product_id": "T023373", "product_identification_helper": { "cpe": "cpe:/a:ibm:hardware_management_console:v10" } } } ], "category": "product_name", "name": "Power Hardware Management Console" }, { "branches": [ { "category": "product_version_range", "name": "IP Edition \u003c4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition \u003c4.2 Fix Pack 23", "product_id": "T046654" } }, { "category": "product_version", "name": "IP Edition 4.2 Fix Pack 23", "product": { "name": "IBM Tivoli Network Manager IP Edition 4.2 Fix Pack 23", "product_id": "T046654-fixed", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:ip_edition___4.2_fix_pack_23" } } } ], "category": "product_name", "name": "Tivoli Network Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003c5", "product": { "name": "Open Source Bootstrap \u003c5", "product_id": "T036126" } }, { "category": "product_version", "name": "5", "product": { "name": "Open Source Bootstrap 5", "product_id": "T036126-fixed", "product_identification_helper": { "cpe": "cpe:/a:getbootstrap:bootstrap:5" } } } ], "category": "product_name", "name": "Bootstrap" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.20.9", "product": { "name": "Open Source Camunda \u003c7.20.9", "product_id": "T039659" } }, { "category": "product_version", "name": "7.20.9", "product": { "name": "Open Source Camunda 7.20.9", "product_id": "T039659-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.20.9" } } }, { "category": "product_version_range", "name": "\u003c7.21.6", "product": { "name": "Open Source Camunda \u003c7.21.6", "product_id": "T039660" } }, { "category": "product_version", "name": "7.21.6", "product": { "name": "Open Source Camunda 7.21.6", "product_id": "T039660-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.21.6" } } }, { "category": "product_version_range", "name": "\u003c7.22.1", "product": { "name": "Open Source Camunda \u003c7.22.1", "product_id": "T039661" } }, { "category": "product_version", "name": "7.22.1", "product": { "name": "Open Source Camunda 7.22.1", "product_id": "T039661-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.22.1" } } }, { "category": "product_version_range", "name": "\u003c7.23.0-alpha2", "product": { "name": "Open Source Camunda \u003c7.23.0-alpha2", "product_id": "T039662" } }, { "category": "product_version", "name": "7.23.0-alpha2", "product": { "name": "Open Source Camunda 7.23.0-alpha2", "product_id": "T039662-fixed", "product_identification_helper": { "cpe": "cpe:/a:camunda:camunda:7.23.0-alpha2" } } } ], "category": "product_name", "name": "Camunda" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "Discovery", "product": { "name": "Red Hat Enterprise Linux Discovery", "product_id": "T040951", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:discovery" } } } ], "category": "product_name", "name": "Enterprise Linux" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-6484", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6484" }, { "cve": "CVE-2024-6485", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6485" }, { "cve": "CVE-2024-6531", "product_status": { "known_affected": [ "T039661", "T039660", "2951", "T039659", "T042208", "T040951", "T036126", "T039662", "T046654", "T023373", "T043089" ] }, "release_date": "2024-07-11T22:00:00.000+00:00", "title": "CVE-2024-6531" } ] }
fkie_cve-2024-6531
Vulnerability from fkie_nvd
URL | Tags |
---|
Vendor | Product | Version |
---|
{ "cveTags": [], "descriptions": [ { "lang": "en", "value": "Rejected reason: This was not a security issue in Bootstrap. Bootstrap\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\u2019s security model, and the associated CVE has been rescinded." } ], "id": "CVE-2024-6531", "lastModified": "2025-08-01T18:15:31.217", "metrics": {}, "published": "2024-07-11T18:15:06.207", "references": [], "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c", "vulnStatus": "Rejected" }
ghsa-vc8w-jr9v-vj7f
Vulnerability from github
5.3 (Medium) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L
Withdrawn Advisory
This advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap’s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap’s security model, and the associated CVE has been rescinded.
Original Descripton
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
{ "affected": [ { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "npm", "name": "bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "RubyGems", "name": "bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "NuGet", "name": "bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "NuGet", "name": "bootstrap.sass" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "Packagist", "name": "twbs/bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "Maven", "name": "org.webjars:bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] }, { "database_specific": { "last_known_affected_version_range": "\u003c= 4.6.2" }, "package": { "ecosystem": "Maven", "name": "org.webjars.npm:bootstrap" }, "ranges": [ { "events": [ { "introduced": "4.0.0" }, { "fixed": "5.0.0" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2024-6531" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2024-08-01T21:29:23Z", "nvd_published_at": "2024-07-11T18:15:06Z", "severity": "MODERATE" }, "details": "## Withdrawn Advisory\nThis advisory is withdrawn because it was not a security issue in Bootstrap. Bootstrap\u2019s JavaScript is not intended to sanitize unsafe or intentionally dangerous HTML. As such, the reported behavior fell outside the scope of Bootstrap\u2019s security model, and the associated CVE has been rescinded.\n\n## Original Descripton\n\nA vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an \u003ca\u003e tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim\u0027s browser.", "id": "GHSA-vc8w-jr9v-vj7f", "modified": "2025-10-09T20:55:06Z", "published": "2024-07-11T18:31:14Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6531" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml" }, { "type": "PACKAGE", "url": "https://github.com/twbs/bootstrap" }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00021.html" }, { "type": "WEB", "url": "https://www.herodevs.com/vulnerability-directory/cve-2024-6531" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L", "type": "CVSS_V3" }, { "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:L", "type": "CVSS_V4" } ], "summary": "Withdrawn Advisory: Bootstrap Cross-Site Scripting (XSS) vulnerability", "withdrawn": "2025-10-09T20:55:06Z" }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.