CVE-2024-40693

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

IBM Planning Analytics 2.0 and 2.1 could be vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. Attackers can make use of this weakness and upload malicious executable files into the system, and it can be sent to victim for performing further attacks.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
IBMPlanning Analytics Local2.0, 2.1

References

Timeline

Published
Jan 24, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-406958.0IBM Cognos Analytics 11.2.0 through 11.2.4 FP4 and 12.0.0 through 12.0.4 could be vulnerable to malicious file upload by not validatingCVE-2024-406965.4IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.3 Standard Edition is vulnerable to cross-site scripting. ThisCVE-2024-406977.5IBM Common Licensing 9.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromCVE-2024-40707.5A vulnerability has been found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This vulnerability aCVE-2024-407006.1IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows anCVE-2024-407028.2IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain accessCVE-2024-407035.5IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0CVE-2024-407044.9IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. CVE-2024-407056.5IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM XCVE-2024-407064.3IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks aCVE-2024-407097.8A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.CVE-2024-40718.8A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some u
CVE-2024-40693: High severity, CVSS 8.0 | Vulnix