CVE-2024-45636

MediumCVSS 4.4/10Last modified Oct 2, 2026

Description

IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-256CWE-522

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2026
Last modified
Oct 2, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-456384.4IBM Security QRadar 3.12 EDR stores user credentials in plain text which can be read by a local privileged user.CVE-2024-45646.4The CoDesigner WooCommerce Builder for Elementor – Customize Checkout, Shop, Email, Products & More plugin for WordPress is vulnerable to StCVE-2024-456405.3IBM Security ReaQta 3.12 returns sensitive information in an HTTP response that could be used in further attacks against the system.CVE-2024-456416.5IBM Security ReaQta EDR 3.12 could allow an attacker to perform unauthorized actions due to improper SSL certificate validation.CVE-2024-456425.3IBM Security ReaQta 3.12 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript coCVE-2024-456437.5IBM Security QRadar 3.12 EDR uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive credentialCVE-2024-456444.7IBM Security ReaQta 3.12 allows a privileged user to upload or transfer files of dangerous types that can be automatically processed within CVE-2024-456479.8IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverifiedCVE-2024-45656.5The Advanced Custom Fields (ACF) WordPress plugin before 6.3, Advanced Custom Fields Pro WordPress plugin before 6.3 allows you to display cCVE-2024-456507.5IBM Security Verify Directory 10.0 through 10.0.3 is vulnerable to a denial of service when sending an LDAP extended operation.CVE-2024-456516.5IBM Sterling Connect:Direct Web Services 6.1.0, 6.2.0, and 6.3.0 does not invalidate session after a browser closure which could allow an CVE-2024-456527.5IBM Maximo MXAPIASSET API 7.6.1.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially cr
CVE-2024-45636: Medium severity, CVSS 4.4 | Vulnix