deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Ajenti version version 2 contains a Improper Error Handling vulnerability in Login JSON request that can result in The requisition leaks a path of the server. This attack appear to be exploitable via By sending a malformed JSON, the tool responds with a traceback error that leaks a path of the server.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee; https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: WOlfCMS WolfCMS version version 0.8.3.1 contains a Stored Cross-Site Scripting vulnerability in Layout Name (from Layout tab) that can result in low privilege user can steal the cookie of admin user and compromise the admin account. This attack appear to be exploitable via Need to enter the Javascript code into Layout Name .
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/wolfcms/wolfcms/issues/667; https://github.com/wolfcms/wolfcms/issues/667
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: ClamAV version version 0.99.3 contains a Out of bounds heap memory read vulnerability in XAR parser, function xar_hash_check() that can result in Leaking of memory, may help in developing exploit chains.. This attack appear to be exploitable via The victim must scan a crafted XAR file. This vulnerability appears to have been fixed in after commit d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: http://www.openwall.com/lists/oss-security/2017/09/29/4; https://github.com/Cisco-Talos/clamav-devel/commit/d96a6b8bcc7439fa7e3876207aa0a8e79c8451b6; https://lists.debian.org/debian-lts-announce/2018/03/msg00011.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross ite Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://blog.apps.npr.org/2018/02/15/pym-security-vulnerability.html; https://github.com/nprapps/pym.js; https://github.com/nprapps/pym.js/issues/170
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker can execute the JavaScript into the "Create New File" and "Create New Directory" input box from 'files'.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://cveexploit.blogspot.in/; https://github.com/wolfcms/wolfcms/issues/666; https://cveexploit.blogspot.in/
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/doorkeeper-gem/doorkeeper/issues/969; https://github.com/doorkeeper-gem/doorkeeper/pull/970; https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
CVSS Score: 7.4 (HIGH)
CWE: CWE-532
References: https://github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef; https://github.com/anymail/django-anymail/releases/tag/v1.4; https://github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: textpattern version version 4.6.2 contains a XML Injection vulnerability in Import XML feature that can result in Denial of service in context to the web server by exhausting server memory resources. This attack appear to be exploitable via Uploading a specially crafted XML file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://github.com/textpattern/textpattern/issues/1141; https://github.com/textpattern/textpattern/issues/1141
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control of program execution flow, leading to remote code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/mwarning/KadNode/issues/79; https://github.com/mwarning/KadNode/issues/79
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: CMS Made Simple version versions 2.2.5 contains a Cross ite Request Forgery (CSRF) vulnerability in Admin profile page that can result in Details can be found here http://dev.cmsmadesimple.org/bug/view/11715. This attack appear to be exploitable via A specially crafted web page. This vulnerability appears to have been fixed in 2.2.6.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://dev.cmsmadesimple.org/bug/view/11715; http://dev.cmsmadesimple.org/bug/view/11715
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/amjuarez/bytecoin/issues/217; https://github.com/cryptonotefoundation/cryptonote/issues/172; https://www.ayrx.me/cryptonote-unauthenticated-json-rpc
CVE: CVE-2018-1050
Published: 2018-03-13
Description: All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476, CWE-476
References: http://www.securityfocus.com/bid/103387; http://www.securitytracker.com/id/1040493; https://access.redhat.com/errata/RHSA-2018:1860
CVE: CVE-2018-1057
Published: 2018-03-13
Description: On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).
CVSS Score: 8.8 (HIGH)
CWE: CWE-863, CWE-863
References: http://www.securityfocus.com/bid/103382; http://www.securitytracker.com/id/1040494; https://bugzilla.redhat.com/show_bug.cgi?id=1553553
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using subpath volume mounts with any volume type (including non-privileged pods, subject to file permissions) can access files/directories outside of the volume, including the host's filesystem.
CVSS Score: 8.8 (HIGH)
CWE: CWE-59
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html; https://access.redhat.com/errata/RHSA-2018:0475; https://github.com/bgeesaman/subpath-exploit/
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
CVSS Score: 7.1 (HIGH)
References: https://access.redhat.com/errata/RHSA-2018:0475; https://github.com/kubernetes/kubernetes/issues/60814; https://access.redhat.com/errata/RHSA-2018:0475
CVE: CVE-2018-6294
Published: 2018-03-13
Description: Unsecured way of firmware update in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6295
Published: 2018-03-13
Description: Unencrypted way of remote control and communications in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-319
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6296
Published: 2018-03-13
Description: An undocumented (hidden) capability for switching the web interface in Hanwha Techwin Smartcams
CVSS Score: 5.3 (MEDIUM)
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6297
Published: 2018-03-13
Description: Buffer overflow in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6298
Published: 2018-03-13
Description: Remote code execution in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6299
Published: 2018-03-13
Description: Authentication bypass in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6300
Published: 2018-03-13
Description: Remote password change in Hanwha Techwin Smartcams
CVSS Score: 9.8 (CRITICAL)
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6301
Published: 2018-03-13
Description: Arbitrary camera access and monitoring via cloud in Hanwha Techwin Smartcams
CVSS Score: 7.5 (HIGH)
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6302
Published: 2018-03-13
Description: Denial of service by blocking of new camera registration on the cloud server in Hanwha Techwin Smartcams
CVSS Score: 7.5 (HIGH)
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6303
Published: 2018-03-13
Description: Denial of service by uploading malformed firmware in Hanwha Techwin Smartcams
CVSS Score: 7.5 (HIGH)
References: https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/; https://securelist.com/somebodys-watching-when-cameras-are-more-than-just-smart/84309/
CVE: CVE-2018-6304
Published: 2018-03-13
Description: Stack overflow in custom XML-parser in Gemalto's Sentinel LDK RTE version before 7.65 leads to remote denial of service
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf; https://sentinel.gemalto.com/technical-support/security-updates-sm/; https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf
CVE: CVE-2018-6305
Published: 2018-03-13
Description: Denial of service in Gemalto's Sentinel LDK RTE version before 7.65
CVSS Score: 7.5 (HIGH)
References: https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf; https://sentinel.gemalto.com/technical-support/security-updates-sm/; https://cert-portal.siemens.com/productcert/pdf/ssa-566773.pdf
CVE: CVE-2017-17442
Published: 2018-03-13
Description: In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000047227; https://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000048073; http://support.blackberry.com/kb/articleDetail?articleNumber=000047227
CVE: CVE-2018-7750
Published: 2018-03-13
Description: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://www.securityfocus.com/bid/103713; https://access.redhat.com/errata/RHSA-2018:0591; https://access.redhat.com/errata/RHSA-2018:0646
CVE: CVE-2017-16250
Published: 2018-03-13
Description: A vulnerability in Mitel ST 14.2, release GA28 and earlier, could allow an attacker to use the API function to enumerate through user-ids which could be used to identify valid user ids and associated user names.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2017-16251
Published: 2018-03-13
Description: A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of the application.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004; https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004
CVE: CVE-2018-7405
Published: 2018-03-13
Description: Cross-site scripting (XSS) in Zoho ManageEngine EventLog Analyzer before 11.12 Build 11120 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://pitstop.manageengine.com/portal/community/topic/security-notice; https://www.manageengine.com/products/eventlog/release-notes.html; https://pitstop.manageengine.com/portal/community/topic/security-notice
CVE: CVE-2018-1227
Published: 2018-03-13
Description: Pivotal Concourse after 2018-03-05 might allow remote attackers to have an unspecified impact, if a customer obtained the Concourse software from a DNS domain that is no longer controlled by Pivotal. The original domain for the Concourse CI (concourse-dot-ci) open source project has been registered by an unknown actor, and is therefore no longer the official website for Concourse CI. The new official domain is concourse-ci.org. At approximately 4 am EDT on March 7, 2018 the Concourse OSS team began receiving reports that the Concourse domain was not responding. The Concourse OSS team discovered, upon investigation with both the original and the new domain registrars, that the originating domain registrar had made the domain available for purchase. This was done despite the domain being renewed by the Concourse OSS team through August 2018. For a customer to be affected, they would have needed to access a download from a "concourse-dot-ci" domain web site after March 6, 2018 18:00:00 EST. Accessing that domain is NOT recommended by Pivotal. Anyone who had been using that domain should immediately begin using the concourse-ci.org domain instead. Customers can also safely access Concourse software from the traditionally available locations on the Pivotal Network or GitHub.
CVSS Score: 7.5 (HIGH)
References: https://pivotal.io/security/cve-2018-1227; https://pivotal.io/security/cve-2018-1227
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Ionic Team Cordova plugin iOS Keychain version before commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf contains an Information Exposure Through Log Files (CWE-532) vulnerability in CDVKeychain.m that can result in login, password and other sensitive data leakage. This attack appear to be exploitable via Attacker must have access to victim's iOS logs. This vulnerability appears to have been fixed in after commit 18233ca25dfa92cca018b9c0935f43f78fd77fbf.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-532
References: https://github.com/ionic-team/cordova-plugin-ios-keychain/pull/29/commits/980230645c8ea3b531b85401de5e4bca0f860e42#diff-936020291e4c2115faff0171f20672a4; https://github.com/ionic-team/cordova-plugin-ios-keychain/pull/29/commits/980230645c8ea3b531b85401de5e4bca0f860e42#diff-936020291e4c2115faff0171f20672a4
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: I Librarian I-librarian version 4.8 and earlier contains a XML External Entity (XXE) vulnerability in line 154 of importmetadata.php(simplexml_load_string) that can result in an attacker reading the contents of a file and SSRF. This attack appear to be exploitable via posting xml in the Parameter form_import_textarea.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-611, CWE-918
References: https://github.com/mkucej/i-librarian/issues/116; https://github.com/mkucej/i-librarian/issues/116
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: inversoft prime-jwt version prior to version 1.3.0 or prior to commit 0d94dcef0133d699f21d217e922564adbb83a227 contains an input validation vulnerability in JWTDecoder.decode that can result in a JWT that is decoded and thus implicitly validated even if it lacks a valid signature. This attack appear to be exploitable via an attacker crafting a token with a valid header and body and then requests it to be validated. This vulnerability appears to have been fixed in 1.3.0 and later or after commit 0d94dcef0133d699f21d217e922564adbb83a227.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://github.com/inversoft/prime-jwt/blob/master/CHANGES; https://github.com/inversoft/prime-jwt/issues/2; https://github.com/inversoft/prime-jwt/blob/master/CHANGES
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Ajenti version 2 contains an Information Disclosure vulnerability in Line 176 of the code source that can result in user and system enumeration as well as data from the /etc/ajenti/config.yml file. This attack appears to be exploitable via network connectivity to the web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee; https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: memcached version prior to 1.4.37 contains an Integer Overflow vulnerability in items.c:item_free() that can result in data corruption and deadlocks due to items existing in hash table being reused from free list. This attack appear to be exploitable via network connectivity to the memcached service. This vulnerability appears to have been fixed in 1.4.37 and later.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190, CWE-667
References: https://access.redhat.com/errata/RHSA-2018:2290; https://github.com/memcached/memcached/commit/a8c4a82787b8b6c256d61bd5c42fb7f92d1bae00; https://github.com/memcached/memcached/issues/271
CVE: CVE-2[PII_REDACTED]
Published: 2018-03-13
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2018-7752.  Reason: This candidate is a reservation duplicate of CVE-2018-7752.  Notes: All CVE users should reference CVE-2018-7752 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-1741
Published: 2018-03-14
Description: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to obtain sensitive information caused by improper handling of Administrative Console panel fields. When exploited an attacker could read files on the file system. IBM X-Force ID: 134931.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22012342; http://www.securitytracker.com/id/1040485; https://exchange.xforce.ibmcloud.com/vulnerabilities/134931
CVE: CVE-2018-1386
Published: 2018-03-14
Description: IBM Tivoli Workload Automation for AIX (IBM Workload Scheduler 8.6, 9.1, 9.2, 9.3, and 9.4) contains directories with improper permissions that could allow a local user to with special access to gain root privileges. IBM X-Force ID: 138208.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: http://www.ibm.com/support/docview.wss?uid=swg22012171; https://exchange.xforce.ibmcloud.com/vulnerabilities/138208; http://www.ibm.com/support/docview.wss?uid=swg22012171
CVE: CVE-2018-1435
Published: 2018-03-14
Description: IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in code execution. IBM X-Force ID: 139563.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.ibm.com/support/docview.wss?uid=swg22014198; http://www.securityfocus.com/bid/103404; http://www.securitytracker.com/id/1040563
CVE: CVE-2018-1437
Published: 2018-03-14
Description: IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: http://www.ibm.com/support/docview.wss?uid=swg22014201; http://www.securityfocus.com/bid/103401; http://www.securitytracker.com/id/1040563
CVE: CVE-2018-1441
Published: 2018-03-14
Description: IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139597.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=swg22013557; https://exchange.xforce.ibmcloud.com/vulnerabilities/139597; http://www.ibm.com/support/docview.wss?uid=swg22013557