CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-31891 – IBM Storage Scale privilege escalation
https://notcve.org/view.php?id=CVE-2024-31891
14 Dec 2024 — IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 contains a local privilege escalation vulnerability. A malicious actor with command line access to the 'scalemgmt' user can elevate privileges to gain root access to the host operating system. • https://www.ibm.com/support/pages/node/7178098 • CWE-250: Execution with Unnecessary Privileges •
CVSS: 7.6EPSS: 0%CPEs: 2EXPL: 0CVE-2024-31892 – IBM Storage Scale SQL injection
https://notcve.org/view.php?id=CVE-2024-31892
14 Dec 2024 — IBM Storage Scale GUI 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1 could allow a user to perform unauthorized actions after intercepting and modifying a csv file due to improper neutralization of formula elements. • https://www.ibm.com/support/pages/node/7178098 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-38002 – IBM Storage Scale session fixation
https://notcve.org/view.php?id=CVE-2023-38002
30 Apr 2024 — IBM Storage Scale 5.1.0.0 through 5.1.9.2 could allow an authenticated user to steal or manipulate an active session to gain access to the system. IBM X-Force ID: 260208. IBM Storage Scale 5.1.0.0 a 5.1.9.2 podría permitir que un usuario autenticado robe o manipule una sesión activa para obtener acceso al sistema. ID de IBM X-Force: 260208. • https://exchange.xforce.ibmcloud.com/vulnerabilities/260208 • CWE-384: Session Fixation •