CVE-2024-35160

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Watson Query on Cloud Pak for Data 1.8, 2.0, 2.1, 2.2 and IBM Db2 Big SQL on Cloud Pak for Data 7.3, 7.4, 7.5, and 7.6 could allow an authenticated user to obtain sensitive information due to insufficient session expiration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-613

Affected software

Vendor	Product	Versions
IBM	Watson Query for Cloud Pak for Data	1.8, 2.0, 2.1, 2.2
IBM	Db2 Big SQL on Cloud Pak for Data	7.3, 7.4, 7.5, 7.6

References

https://www.ibm.com/support/pages/node/7168703Vendor Advisory
https://www.ibm.com/support/pages/node/7176947Vendor Advisory

Timeline

Published: Nov 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-351617.5Apache Traffic Server forwards malformed HTTP chunked trailer section to origin servers. This can be utilized for request smuggling and may CVE-2024-351626.5Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploite CVE-2024-351647.5The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based prot CVE-2024-351655.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gutenify.This issue affects Gutenify: from n/a through 1.4.0.CVE-2024-351667.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ninja Team Filebird.This issue affects Filebird: from n/a throug CVE-2024-351675.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo's Elementor Templates CVE-2024-351684.3Missing Authorization vulnerability in Discourse WP Discourse.This issue affects WP Discourse: from n/a through 2.5.1.CVE-2024-351695.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in all_bootstrap_blocks All Bootstrap Blo CVE-2024-35175.4The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Accordion Widget CVE-2024-351705.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hidden Depth Sticky banner allows Stor CVE-2024-351715.3Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Academy LMS academy.This issue affects Academy LMS: from n/a thr CVE-2024-351724.4Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects Shor