Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2018-1771
IBM Domino 9.0 and 9.0.1 could allow an attacker to execute commands on the system by triggering a buffer overflow in the parsing of command line arguments passed to nsd.exe. IBM X-force ID: 148687.
Affected Products: Domino
References: [{'name': 'ibm-notes-cve20181771-priv-escalation(148687)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148687'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10743405'}]
CVE State: PUBLISHED
Explain CVE-2018-1772
IBM SPSS Analytic Server 3.1.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148689.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10791853'}, {'name': '106630', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106630'}, {'name': 'ibm-spss-cve20181772-xss(148689)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148689'}]
CVE State: PUBLISHED
Explain CVE-2018-1773
IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an authenticated user to bypass future authentication mechanisms once the initial login is completed.  IBM X-Force ID: 148691.
Affected Products: Datacap
References: [{'name': '105340', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105340'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10729013'}, {'name': 'ibm-datacap-cve20181773-sec-bypass(148691)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148691'}]
CVE State: PUBLISHED
Explain CVE-2018-1774
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.
Affected Products: API Connect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10737867'}, {'name': 'ibm-api-cve20181774-script-injection(148692)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148692'}]
CVE State: PUBLISHED
Explain CVE-2018-1775
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
Affected Products: torwize V7000
References: [{'name': '107187', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107187'}, {'name': 'ibm-storwize-cve20181775-file-download(148757)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148757'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10872486'}]
CVE State: PUBLISHED
Explain CVE-2018-1777
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148800.
Affected Products: WebSphere Application Server
References: [{'name': '1041873', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041873'}, {'name': 'ibm-websphere-cve20181777-xss(148800)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148800'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10730631'}]
CVE State: PUBLISHED
Explain CVE-2018-1778
IBM LoopBack (IBM API Connect 2018.1, 2018.4.1, 5.0.8.0, and 5.0.8.4) could allow an attacker to bypass authentication if the AccessToken Model is exposed over a REST API, it is then possible for anyone to create an AccessToken for any User provided they know the userId and can hence get access to the other user&#195;&#162;&#194;&#128;&#194;&#153;s data / access to their privileges (if the user happens to be an Admin for example). IBM X-Force ID: 148801.
Affected Products: API Connect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733883'}, {'name': 'ibm-loopback-cve20181778-auth-bypass(148801)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148801'}, {'name': '106313', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106313'}]
CVE State: PUBLISHED
Explain CVE-2018-1779
IBM API Connect 2018.1 through 2018.3.7 could allow an unauthenticated attacker to cause a denial of service due to not setting limits on JSON payload size. IBM X-Force ID: 148802.
Affected Products: API Connect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10733851'}, {'name': 'ibm-api-cve20181779-dos(148802)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148802'}, {'name': '105991', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105991'}]
CVE State: PUBLISHED
Explain CVE-2018-1780
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148803.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': '105885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105885'}, {'name': 'ibm-db2-cve20181780-priv-escalation(148803)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148803'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733939'}, {'name': '1042086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042086'}]
CVE State: PUBLISHED
Explain CVE-2018-1781
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148804.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': 'ibm-db2-20181781-priv-escalation(148804)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148804'}, {'name': '105885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105885'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733939'}, {'name': '1042086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042086'}]
CVE State: PUBLISHED
Explain CVE-2018-1782
IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, unprivileged user to cause a kernel panic on a node running GPFS by accessing a file that is stored on a GPFS file system with mmap, or by executing a crafted file stored on a GPFS file system. IBM X-Force ID: 148805.
Affected Products: Spectrum Scale
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10730967'}, {'name': 'ibm-spectrum-cve20181782-dos(148805)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148805'}]
CVE State: PUBLISHED
Explain CVE-2018-1783
IBM GPFS (IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10, 5.0.0 and 5.0.1.2) command line utility allows an unprivileged, authenticated user with access to a GPFS node to forcefully terminate GPFS and deny access to data available through GPFS. IBM X-Force ID: 148806.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10732717'}, {'name': 'ibm-spectrum-cve20181783-dos(148806)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148806'}]
CVE State: PUBLISHED
Explain CVE-2018-1784
IBM API Connect 5.0.0.0 and 5.0.8.4 is affected by a NoSQL Injection in MongoDB connector for the LoopBack framework. IBM X-Force ID: 148807.
Affected Products: API Connect
References: [{'name': '106316', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106316'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10737883'}, {'name': 'ibm-api-cve20181784-nosql-injection(148807)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148807'}]
CVE State: PUBLISHED
Explain CVE-2018-1785
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information. IBM X-Force ID: 148870.
Affected Products: Spectrum Protect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10729873'}, {'name': '1041716', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041716'}, {'name': 'ibm-tivoli-cve20181785-info-disc(148870)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148870'}]
CVE State: PUBLISHED
Explain CVE-2018-1786
IBM Spectrum Protect 7.1 and 8.1 dsmc and dsmcad processes incorrectly accumulate TCP/IP sockets in a CLOSE_WAIT state. This can cause TCP/IP resource leakage and may result in a denial of service. IBM X-Force ID: 148871.
Affected Products: Spectrum Protect
References: [{'name': 'ibm-tivoli-cve20181786-dos(148871)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148871'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10738765'}, {'name': '105940', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105940'}]
CVE State: PUBLISHED
Explain CVE-2018-1787
IBM Spectrum Protect 7.1 and 8.1 is affected by a password exposure vulnerability caused by insecure file permissions. IBM X-Force ID: 148872.
Affected Products: Spectrum Protect
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10869602'}, {'name': 'ibm-tivoli-cve20181787-info-disc (148872)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148872'}]
CVE State: PUBLISHED
Explain CVE-2018-1788
IBM Spectrum Protect Server 7.1 and 8.1 could disclose highly sensitive information via trace logs to a local privileged user. IBM X-Force ID: 148873.
Affected Products: Spectrum Protect
References: [{'name': 'ibm-tivoli-cve20181788-info-disc(148873)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148873'}, {'name': '105818', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105818'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10730357'}, {'name': '1042032', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042032'}]
CVE State: PUBLISHED
Explain CVE-2018-1789
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
Affected Products: API Connect
References: [{'name': 'ibm-api-cve20181789-ssrf(148939)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148939'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10728517'}]
CVE State: PUBLISHED
Explain CVE-2018-1790
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.
Affected Products: Financial Transaction Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10731607'}, {'name': 'ibm-ftm-cve20181790-csrf (148944)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148944'}]
CVE State: PUBLISHED
Explain CVE-2018-1791
IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID: 148946.
Affected Products: Connections
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10731207'}, {'name': 'ibm-connections-cve20181791-esi(148946)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148946'}]
CVE State: PUBLISHED
Explain CVE-2018-1792
IBM WebSphere MQ 8.0.0.0 through 8.0.0.10, 9.0.0.0 through 9.0.0.5, 9.0.1 through 9.0.5, and 9.1.0.0 could allow a local user to inject code that could be executed with root privileges. IBM X-Force ID: 148947.
Affected Products: MQ
References: [{'name': '105936', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105936'}, {'name': 'ibm-websphere-cve20181792-priv-escalation(148947)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148947'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10734447'}]
CVE State: PUBLISHED
Explain CVE-2018-1793
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148948.
Affected Products: WebSphere Application Server
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10729563'}, {'name': 'ibm-websphere-cve20181793-xss(148948)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148948'}, {'name': '1041801', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041801'}]
CVE State: PUBLISHED
Explain CVE-2018-1794
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using OAuth ear is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 148949.
Affected Products: WebSphere Application Server
References: [{'name': 'ibm-websphere-cve20181794-xss(148949)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/148949'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10729571'}, {'name': '1041802', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041802'}]
CVE State: PUBLISHED
Explain CVE-2018-1795
IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149073.
Affected Products: Robotic Process Automation with Automation Anywhere
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10730615'}, {'name': 'ibm-rpa-cve20181795-xss(149073)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149073'}]
CVE State: PUBLISHED
Explain CVE-2018-1796
IBM Informix Dynamic Server Enterprise Edition 12.1 could allow a local user to load malicious libraries and gain root privileges. IBM X-Force ID: 149426.
Affected Products: Informix Dynamic Server Enterprise Edition
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10964987'}, {'name': 'ibm-informix-cve20181796-priv-escalation (149426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149426'}]
CVE State: PUBLISHED
Explain CVE-2018-1797
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as "Zip-Slip". IBM X-Force ID: 149427.
Affected Products: WebSphere Application Server
References: [{'name': 'ibm-websphere-cve20181797-file-write(149427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149427'}, {'name': '105982', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105982'}, {'name': '1042146', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042146'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10730699'}]
CVE State: PUBLISHED
Explain CVE-2018-1798
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149428.
Affected Products: WebSphere Application Server
References: [{'name': '1042053', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042053'}, {'name': 'ibm-websphere-cve20181798-xss(149428)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149428'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10730703'}, {'name': '105945', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105945'}]
CVE State: PUBLISHED
Explain CVE-2018-1799
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwrite files on the system which could cause damage to the database. IBM X-Force ID: 149429.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': '105885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105885'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733939'}, {'name': 'ibm-db2-cve20181799--file-write(149429)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149429'}, {'name': '1042086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042086'}]
CVE State: PUBLISHED
Explain CVE-2018-1800
IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could allow a local user to obtain highly sensitive information during a short time period when installation is occurring. IBM X-Force ID: 149607.
Affected Products: Sterling B2B Integrator
References: [{'name': 'ibm-sterling-cve20181800-info-disc(149607)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149607'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10731379'}]
CVE State: PUBLISHED
Explain CVE-2018-1801
IBM App Connect V11.0.0.0 through V11.0.0.1, IBM Integration Bus V10.0.0.0 through V10.0.0.13, IBM Integration Bus V9.0.0.0 through V9.0.0.10, and WebSphere Message Broker V8.0.0.0 through V8.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to consume memory resources. IBM X-Force ID: 149639.
Affected Products: Integration Bus
References: [{'name': 'ibm-ibus-cve20181801-dos(149639)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149639'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10795780'}]
CVE State: PUBLISHED
Explain CVE-2018-1802
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': '105962', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105962'}, {'name': 'ibm-db2-cve20181802-priv-escalation(149640)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149640'}, {'name': '1042082', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042082'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733122'}]
CVE State: PUBLISHED
Explain CVE-2018-1803
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 149702.
Affected Products: Security Access Manager Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}, {'name': 'ibm-sam-cve20181803-clickjacking(149702)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149702'}]
CVE State: PUBLISHED
Explain CVE-2018-1804
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.
Affected Products: Security Access Manager Appliance
References: [{'name': 'ibm-sam-cve20181804-info-disc(149703)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149703'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}]
CVE State: PUBLISHED
Explain CVE-2018-1805
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 149704.
Affected Products: Security Access Manager Appliance
References: [{'name': 'ibm-sam-cve20181805-info-disc(149704)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149704'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}]
CVE State: PUBLISHED
Explain CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.
Affected Products: WebSphere Commerce
References: [{'name': '1042034', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042034'}, {'name': 'ibm-websphere-cve20181808-ssi(149828)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149828'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www-01.ibm.com/support/docview.wss?uid=ibm10735905'}]
CVE State: PUBLISHED
Explain CVE-2018-1812
IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to persistent cross-site scripting, caused by missing escaping of a database field. An attacker that has access to the Control Room database could exploit this vulnerability to execute script in a victim's web browser within the security context of the hosting Web site, once victim opens a certain page in Control Room. IBM X-Force ID: 149883.
Affected Products: Robotic Process Automation with Automation Anywhere
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10731925'}, {'name': 'ibm-robotic-cve20181812-xss(149883)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/149883'}]
CVE State: PUBLISHED
Explain CVE-2018-1813
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.
Affected Products: Security Access Manager Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}, {'name': 'ibm-sam-cve20181813-input-validation(150017)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150017'}]
CVE State: PUBLISHED
Explain CVE-2018-1814
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 150018.
Affected Products: Security Access Manager Appliance
References: [{'name': 'ibm-sam-cve20181814-info-disc(150018)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150018'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}]
CVE State: PUBLISHED
Explain CVE-2018-1815
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150019.
Affected Products: Security Access Manager Appliance
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10787785'}, {'name': 'ibm-sam-cve20181815-xss(150019)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150019'}]
CVE State: PUBLISHED
Explain CVE-2018-1817
IBM Security Guardium 10 and 10.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150021.
Affected Products: Security Guardium
References: [{'name': 'ibm-guardium-cve20181817-xss(150021)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150021'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10737069'}]
CVE State: PUBLISHED
Explain CVE-2018-1818
IBM Security Guardium 10 and 10.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 150022.
Affected Products: Security Guardium
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10737073'}, {'name': 'ibm-guardium-cve20181818-info-disc(150022)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150022'}]
CVE State: PUBLISHED
Explain CVE-2018-1819
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-force ID: 150023.
Affected Products: Financial Transaction Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10732361'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10732357'}, {'name': 'ibm-ftm-cve20181819-sql-injection(150023)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150023'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10732367'}]
CVE State: PUBLISHED
Explain CVE-2018-1820
IBM WebSphere Portal 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150096.
Affected Products: WebSphere Portal
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10732287'}, {'name': '1041751', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1041751'}, {'name': 'ibm-websphere-cve20181820-xss(150096)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150096'}]
CVE State: PUBLISHED
Explain CVE-2018-1821
IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.
Affected Products: Operational Decision Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10744149'}, {'name': '106325', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106325'}, {'name': '46017', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/46017/'}, {'name': 'ibm-websphere-cve20181821-xxe(150170)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150170'}]
CVE State: PUBLISHED
Explain CVE-2018-1822
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.
Affected Products: FlashSystem 900
References: [{'name': 'ibm-flashsystem-cve20181822-sec-bypass(150296)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150296'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10732962'}]
CVE State: PUBLISHED
Explain CVE-2018-1823
IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150426.
Affected Products: Rational Quality Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875318'}, {'name': 'ibm-rqm-cve20181823-xss(150426)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150426'}, {'name': '107433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107433'}]
CVE State: PUBLISHED
Explain CVE-2018-1824
IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150427.
Affected Products: Rational Quality Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875318'}, {'name': 'ibm-rqm-cve20181824-xss(150427)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150427'}, {'name': '107433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107433'}]
CVE State: PUBLISHED
Explain CVE-2018-1825
IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150428.
Affected Products: Rational Quality Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875318'}, {'name': 'ibm-rqm-cve20181825-xss(150428)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150428'}, {'name': '107433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107433'}]
CVE State: PUBLISHED
Explain CVE-2018-1826
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150429.
Affected Products: Rational Collaborative Lifecycle Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10956525'}, {'name': 'ibm-rqm-cve20181826-xss (150429)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150429'}]
CVE State: PUBLISHED
Explain CVE-2018-1827
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150430.
Affected Products: Rational Collaborative Lifecycle Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10956525'}, {'name': 'ibm-rqm-cve20181827-xss (150430)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150430'}]
CVE State: PUBLISHED
Explain CVE-2018-1828
IBM Rational Collaborative Lifecycle Management 6.0 through 6.0.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150431.
Affected Products: Rational Collaborative Lifecycle Management
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10956525'}, {'name': 'ibm-rqm-cve20181828-xss (150431)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150431'}]
CVE State: PUBLISHED
Explain CVE-2018-1829
IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150432.
Affected Products: Rational Quality Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10875318'}, {'name': 'ibm-rqm-cve20181829-xss(150432)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150432'}, {'name': '107433', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107433'}]
CVE State: PUBLISHED
Explain CVE-2018-1833
IBM Event Streams 2018.3.0 could allow a remote attacker to submit an API request with a fake Host request header. An attacker, who has already gained authorised access via the CLI, could exploit this vulnerability to spoof the request header. IBM X-Force ID: 150507.
Affected Products: Event Streams
References: [{'name': '106330', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106330'}, {'name': 'ibm-events-cve20181833-host-header(150507)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150507'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10787535'}]
CVE State: PUBLISHED
Explain CVE-2018-1834
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to escalate their privileges to root through a symbolic link attack. IBM X-Force ID: 150511.
Affected Products: DB2 for Linux, UNIX and Windows
References: [{'name': '105885', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105885'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733939'}, {'name': '1042086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042086'}, {'name': 'ibm-db2-cve20181834-priv-escalation(150511)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150511'}]
CVE State: PUBLISHED
Explain CVE-2018-1835
IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150514.
Affected Products: Daeja ViewONE
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10733815'}, {'name': 'ibm-dejaviewone-cve20181835-xxe(150514)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150514'}]
CVE State: PUBLISHED
Explain CVE-2018-1836
IBM WebSphere MQ 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.1.0.0, and 9.1.0.1 console is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150661.
Affected Products: MQ
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10734457'}, {'name': 'ibm-websphere-cve20181836-xss (150661)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150661'}, {'name': '107530', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/107530'}]
CVE State: PUBLISHED
Explain CVE-2018-1838
IBM WebSphere Application Server 8.5 and 9.0 in IBM Cloud could allow a remote attacker to obtain sensitive information caused by improper handling of passwords. IBM X-Force ID: 150811.
Affected Products: WebSphere Application Server
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10734167'}, {'name': 'ibm-websphere-cve20181838-info-disc(150811)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150811'}]
CVE State: PUBLISHED
Explain CVE-2018-1840
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813.
Affected Products: WebSphere Application Server
References: [{'name': 'ibm-websphere-cve20181840-priv-escalation(150813)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150813'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10735767'}, {'name': '106141', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106141'}]
CVE State: PUBLISHED
Explain CVE-2018-1841
IBM Cloud Private 2.1.0 could allow a local user to obtain the CA Private Key due to it being world readable in boot/master node. IBM X-Force ID: 150901.
Affected Products: Cloud Private
References: [{'name': 'ibm-cloud-cve20181841-info-disc(150901)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150901'}, {'name': '105980', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105980'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10739851'}]
CVE State: PUBLISHED
Explain CVE-2018-1842
IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its id_token. IBM X-Force ID: 150902.
Affected Products: Cognos Analytics
References: [{'name': 'ibm-cognos-cve20181842-auth-bypass(150902)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150902'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10738249'}, {'name': '1042031', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20190401-0003/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20190329-0003/'}]
CVE State: PUBLISHED
Explain CVE-2018-1843
The Identity and Access Management (IAM) services (IBM Cloud Private 3.1.0) do not use a secure channel, such as SSL, to exchange information only when accessed internally from within the cluster. It could be possible for an attacker with access to network traffic to sniff packets from the connection and uncover data. IBM X-Force ID: 150903
Affected Products: Cloud Private
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10739845'}, {'name': 'ibm-cloud-cve20181843-info-disc(150903)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150903'}]
CVE State: PUBLISHED
Explain CVE-2018-1844
IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150904.
Affected Products: FileNet Content Manager
References: [{'name': 'ibm-case-cve20181844-info-disc(150904)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150904'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10732755'}]
CVE State: PUBLISHED
Explain CVE-2018-1845
IBM InfoSphere Information Server 11.3, 11.5, and 11.7 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150905.
Affected Products: InfoSphere Information Server
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10738917'}, {'name': 'ibm-infosphere-cve20181845-xxe (150905)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150905'}]
CVE State: PUBLISHED
Explain CVE-2018-1846
IBM Rational Engineering Lifecycle Manager 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150945.
Affected Products: Rational Engineering Lifecycle Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10738075'}, {'name': 'ibm-relm-cve20181846-info-disc(150945)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150945'}]
CVE State: PUBLISHED
Explain CVE-2018-1847
IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) v2.0.0.0 through 2.0.0.5, v2.1.0.0 through 2.1.0.4, v2.1.1.0 through 2.1.1.4, and v3.0.0.0 through 3.0.0.8 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 150946.
Affected Products: Financial Transaction Manager
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/pages/security-bulletin-path-traversal-exposure-saveexport-function-ftm-oac'}, {'name': 'ibm-ftm-cve20181847-info-disc (150946)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150946'}]
CVE State: PUBLISHED
Explain CVE-2018-1848
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 150947.
Affected Products: Business Automation Workflow
References: [{'name': 'ibm-baw-cve20181848-xss(150947)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150947'}, {'name': '106217', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/106217'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10743005'}]
CVE State: PUBLISHED
Explain CVE-2018-1850
IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998.
Affected Products: Security Access Manager Appliance
References: [{'name': 'ibm-sam-cve20181850-auth-bypass(150998)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150998'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ibm.com/support/docview.wss?uid=ibm10734555'}, {'name': '1042036', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id/1042036'}]
CVE State: PUBLISHED
Explain CVE-2018-1851
IBM WebSphere Application Server Liberty OpenID Connect could allow a remote attacker to execute arbitrary code on the system, caused by improper deserialization. By sending a specially-crafted request to the RP service, an attacker could exploit this vulnerability to execute arbitrary code. IBM X-Force ID: 150999.
Affected Products: WebSphere Application Server
References: [{'name': 'ibm-websphere-cve20181851-rce(150999)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/150999'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.ibm.com/support/docview.wss?uid=ibm10735105'}, {'name': '105839', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/105839'}]
CVE State: PUBLISHED