Total
398379 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-28771 | 1 Ibm | 2 Security Directory Integrator, Security Verify Directory Integrator | 2026-06-17 | N/A | 4.8 MEDIUM |
| IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. | |||||
| CVE-2024-28770 | 1 Ibm | 2 Security Directory Integrator, Security Verify Directory Integrator | 2026-06-17 | N/A | 4.8 MEDIUM |
| IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. | |||||
| CVE-2024-28767 | 1 Ibm | 1 Security Directory Integrator | 2026-06-17 | N/A | 6.8 MEDIUM |
| IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. | |||||
| CVE-2024-28766 | 1 Ibm | 2 Security Directory Integrator, Security Verify Directory Integrator | 2026-06-17 | N/A | 2.4 LOW |
| IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the system. | |||||
| CVE-2024-28765 | 1 Ibm | 1 Security Directory Integrator | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. | |||||
| CVE-2024-28764 | 2 Ibm, Linux | 2 Websphere Automation, Linux Kernel | 2026-06-17 | N/A | 6.5 MEDIUM |
| IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623. | |||||
| CVE-2024-28762 | 1 Ibm | 1 Db2 | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.5, 11.1, and 11.5 is vulnerable to denial of service with a specially crafted query under certain conditions. IBM X-Force ID: 285246. | |||||
| CVE-2024-28761 | 1 Ibm | 1 App Connect Enterprise | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 285245. | |||||
| CVE-2024-28760 | 1 Ibm | 1 App Connect Enterprise | 2026-06-17 | N/A | 4.3 MEDIUM |
| IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 dashboard is vulnerable to a denial of service due to improper restrictions of resource allocation. IBM X-Force ID: 285244. | |||||
| CVE-2024-28759 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09. | |||||
| CVE-2024-28757 | 3 Fedoraproject, Libexpat Project, Netapp | 21 Fedora, Libexpat, Active Iq Unified Manager and 18 more | 2026-06-17 | N/A | 7.5 HIGH |
| libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate). | |||||
| CVE-2024-28756 | 1 Solaredge | 1 Mysolaredge | 2026-06-17 | N/A | 5.9 MEDIUM |
| The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (MitM) attacker to read and alter all network traffic between the application and the server. | |||||
| CVE-2024-28755 | 1 Trustedfirmware | 1 Mbed Tls | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue was discovered in Mbed TLS 3.5.x before 3.6.0. When an SSL context was reset with the mbedtls_ssl_session_reset() API, the maximum TLS version to be negotiated was not restored to the configured one. An attacker was able to prevent an Mbed TLS server from establishing any TLS 1.3 connection, potentially resulting in a Denial of Service or forced version downgrade from TLS 1.3 to TLS 1.2. | |||||
| CVE-2024-28754 | 1 Raspap | 1 Raspap | 2026-06-17 | N/A | 7.5 HIGH |
| RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request. | |||||
| CVE-2024-28753 | 1 Raspap | 1 Raspap | 2026-06-17 | N/A | 6.5 MEDIUM |
| RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request. | |||||
| CVE-2024-28752 | 2 Apache, Netapp | 3 Cxf, Oncommand Workflow Automation, Ontap Tools | 2026-06-17 | N/A | 9.3 CRITICAL |
| A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the default databinding) are not impacted. | |||||
| CVE-2024-28751 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| An high privileged remote attacker can enable telnet access that accepts hardcoded credentials. | |||||
| CVE-2024-28750 | 2026-06-17 | N/A | 7.2 HIGH | ||
| A remote attacker with high privileges may use a deleting file function to inject OS commands. | |||||
| CVE-2024-28749 | 2026-06-17 | N/A | 7.2 HIGH | ||
| A remote attacker with high privileges may use a writing file function to inject OS commands. | |||||
| CVE-2024-28748 | 2026-06-17 | N/A | 7.2 HIGH | ||
| A remote attacker with high privileges may use a reading file function to inject OS commands. | |||||