CVE-2024-40700

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Feb 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-407028.2IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow an unauthorized user to obtain valid tokens to gain accessCVE-2024-407035.5IBM Cognos Analytics 11.2.0, 11.2.1, 11.2.2, 11.2.3, 11.2.4, 12.0.0, 12.0.1, 12.0.2, 12.0.3, and IBM Cognos Analytics Reports for iOS 11.0.0CVE-2024-407044.9IBM InfoSphere Information Server 11.7 could allow a privileged user to obtain sensitive information from authentication request headers. CVE-2024-407056.5IBM InfoSphere Information Server could allow an authenticated user to consume file space resources due to unrestricted file uploads. IBM XCVE-2024-407064.3IBM InfoSphere Information Server 11.7 could allow a remote user to obtain sensitive version information that could aid in further attacks aCVE-2024-407097.8A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level.CVE-2024-40718.8A vulnerability was found in Kashipara Online Furniture Shopping Ecommerce Website 1.0 and classified as critical. This issue affects some uCVE-2024-407108.8A series of related high-severity vulnerabilities, the most notable enabling remote code execution (RCE) as the service account and extractiCVE-2024-407119.8A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).CVE-2024-407127.8A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege esCVE-2024-407137.8A vulnerability that allows a user who has been assigned a low-privileged role within Veeam Backup & Replication to alter Multi-Factor AutheCVE-2024-407148.3An improper certificate validation vulnerability in TLS certificate validation allows an attacker on the same network to intercept sensitive