Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
33,036 matching · page 594/661Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2024-52892(opens NVD record) | Medium | 6.1 | IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 6, 2025 |
| CVE-2024-57523(opens NVD record) | Medium | 4.5 | Cross Site Request Forgery (CSRF) in Users.php in SourceCodester Packers and Movers Management System 1.0 allows attackers to create unauthorized admin accounts via crafted requests sent to an authenticated admin user. | Feb 6, 2025 |
| CVE-2024-24911(opens NVD record) | Medium | 5.3 | In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Security Gateway's CRL cache. | Feb 6, 2025 |
| CVE-2024-57962(opens NVD record) | Medium | 6.1 | Vulnerability of incomplete verification information in the VPN service module Impact: Successful exploitation of this vulnerability may affect availability. | Feb 6, 2025 |
| CVE-2024-57961(opens NVD record) | Medium | 6.8 | Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. | Feb 6, 2025 |
| CVE-2024-57960(opens NVD record) | High | 7.7 | Input verification vulnerability in the ExternalStorageProvider module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Feb 6, 2025 |
| CVE-2024-57959(opens NVD record) | Medium | 6.1 | Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. | Feb 6, 2025 |
| CVE-2024-57958(opens NVD record) | Medium | 5.7 | Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. | Feb 6, 2025 |
| CVE-2024-57957(opens NVD record) | Medium | 6.6 | Vulnerability of improper log information control in the UI framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Feb 6, 2025 |
| CVE-2024-57956(opens NVD record) | Low | 2.8 | Out-of-bounds read vulnerability in the interpreter string module Impact: Successful exploitation of this vulnerability may affect availability. | Feb 6, 2025 |
| CVE-2024-57955(opens NVD record) | Medium | 6.1 | Arbitrary write vulnerability in the Gallery module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Feb 6, 2025 |
| CVE-2024-57954(opens NVD record) | Medium | 6.2 | Permission verification vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Feb 6, 2025 |
| CVE-2024-12602(opens NVD record) | Medium | 6.2 | Identity verification vulnerability in the ParamWatcher module Impact: Successful exploitation of this vulnerability may affect service confidentiality. | Feb 6, 2025 |
| CVE-2025-0799(opens NVD record) | Medium | 6.5 | IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the system during bar configuration deployment due to improper pathname limitations on restricted directories. | Feb 6, 2025 |
| CVE-2024-51450(opens NVD record) | Critical | 9.1 | IBM Security Verify Directory 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. | Feb 6, 2025 |
| CVE-2024-49814(opens NVD record) | High | 7.8 | IBM Security Verify Access Appliance 10.0.0 through 10.0.3 could allow a locally authenticated user to increase their privileges due to execution with unnecessary privileges. | Feb 6, 2025 |
| CVE-2024-49800(opens NVD record) | Medium | 4.3 | IBM ApplinX 11.1 stores sensitive information in cleartext in memory that could be obtained by an authenticated user. | Feb 6, 2025 |
| CVE-2024-49798(opens NVD record) | Medium | 4.3 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. | Feb 6, 2025 |
| CVE-2024-49797(opens NVD record) | Medium | 5.9 | IBM ApplinX 11.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. | Feb 6, 2025 |
| CVE-2024-49796(opens NVD record) | Medium | 5.4 | IBM ApplinX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. | Feb 6, 2025 |
| CVE-2024-49795(opens NVD record) | Medium | 4.3 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | Feb 6, 2025 |
| CVE-2024-49794(opens NVD record) | Medium | 4.3 | IBM ApplinX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | Feb 6, 2025 |
| CVE-2024-49793(opens NVD record) | Medium | 5.4 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 6, 2025 |
| CVE-2024-49792(opens NVD record) | Medium | 5.4 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 6, 2025 |
| CVE-2024-49791(opens NVD record) | Medium | 6.4 | IBM ApplinX 11.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 6, 2025 |
| CVE-2024-56473(opens NVD record) | Medium | 5.3 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 could allow an attacker to spoof their IP address, which is written to log files, due to improper verification of 'Client-IP' headers. | Feb 5, 2025 |
| CVE-2024-56472(opens NVD record) | Medium | 6.4 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 5, 2025 |
| CVE-2024-56471(opens NVD record) | Medium | 5.4 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | Feb 5, 2025 |
| CVE-2024-56470(opens NVD record) | Medium | 5.4 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | Feb 5, 2025 |
| CVE-2024-38318(opens NVD record) | Medium | 4.8 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. | Feb 5, 2025 |
| CVE-2024-38317(opens NVD record) | Medium | 4.8 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | Feb 5, 2025 |
| CVE-2024-38316(opens NVD record) | Medium | 4.3 | IBM Aspera Shares 1.9.0 through 1.10.0 PL6 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service. | Feb 5, 2025 |
| CVE-2024-57598(opens NVD record) | Medium | 6.5 | A floating point exception (divide-by-zero) vulnerability was discovered in Bento4 1.6.0-641 in function AP4_TfraAtom() of Ap4TfraAtom.cpp which allows a remote attacker to cause a denial of service vulnerability. | Feb 5, 2025 |
| CVE-2025-24497(opens NVD record) | High | 7.5 | When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-24326(opens NVD record) | High | 7.5 | When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-24320(opens NVD record) | High | 8.0 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156 https://my.f5.com/manage/s/article/K000138636 . Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-24319(opens NVD record) | Medium | 6.5 | When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kubernetes service to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-24312(opens NVD record) | High | 7.5 | When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclosed traffic can cause an increase in CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-23419(opens NVD record) | Medium | 4.3 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentication requirements on these servers. This vulnerability arises when TLS Session Tickets https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_ticket_key are used and/or the SSL session cache https://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache are used in the default server and the default server is performing client certificate authentication. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-23415(opens NVD record) | Low | 3.1 | An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass endpoint inspection checks for VPN connection initiated thru BIG-IP APM browser network access VPN client for Windows, macOS and Linux. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-23413(opens NVD record) | Medium | 4.4 | When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-23412(opens NVD record) | High | 7.5 | When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-23239(opens NVD record) | High | 8.7 | When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-22891(opens NVD record) | High | 7.5 | When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop processing new client connections and an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-22846(opens NVD record) | High | 7.5 | When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-21091(opens NVD record) | High | 7.5 | When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | Feb 5, 2025 |
| CVE-2025-21087(opens NVD record) | High | 7.5 | When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in memory and CPU resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | Feb 5, 2025 |
| CVE-2025-20058(opens NVD record) | High | 7.5 | When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | Feb 5, 2025 |
| CVE-2025-20045(opens NVD record) | High | 7.5 | When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |
| CVE-2025-20029(opens NVD record) | High | 8.8 | Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitrary system commands. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | Feb 5, 2025 |