deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-7783
Published: 2018-07-03
Description: Schneider Electric SoMachine Basic prior to v1.6 SP1 suffers from an XML External Entity (XXE) vulnerability using the DTD parameter entities technique resulting in disclosure and retrieval of arbitrary data on the affected node via out-of-band (OOB) attack. The vulnerability is triggered when input passed to the xml parser is not sanitized while parsing the xml project/template file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-611
References: https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/; https://www.schneider-electric.com/en/download/document/SEVD-2018-142-01/
CVE: CVE-2018-7784
Published: 2018-07-03
Description: In Schneider Electric U.motion Builder software versions prior to v1.3.4, this exploit occurs when the submitted data of an input string is evaluated as a command by the application. In this way, the attacker could execute code, read the stack, or cause a segmentation fault in the running application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104447; https://www.schneider-electric.com/en/download/document/SEVD-2018-151-01/; http://www.securityfocus.com/bid/104447
CVE: CVE-2018-7785
Published: 2018-07-03
Description: In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: http://www.securityfocus.com/bid/104447; https://www.schneider-electric.com/en/download/document/SEVD-2018-151-01/; http://www.securityfocus.com/bid/104447
CVE: CVE-2018-7786
Published: 2018-07-03
Description: In Schneider Electric U.motion Builder software versions prior to v1.3.4, a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104447; https://www.schneider-electric.com/en/download/document/SEVD-2018-151-01/; http://www.securityfocus.com/bid/104447
CVE: CVE-2018-7787
Published: 2018-07-03
Description: In Schneider Electric U.motion Builder software versions prior to v1.3.4, this vulnerability is due to improper validation of input of context parameter in HTTP GET request.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104447; https://www.schneider-electric.com/en/download/document/SEVD-2018-151-01/; http://www.securityfocus.com/bid/104447
CVE: CVE-2018-7635
Published: 2018-07-03
Description: Whale Browser before 1.0.41.8 displays no URL information but only a title of a web page on the browser's address bar when visiting a blank page, which allows an attacker to display a malicious web page with a fake domain name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-20
References: https://cve.naver.com/detail/cve-2018-7635.html; https://cve.naver.com/detail/cve-2018-7635.html
CVE: CVE-2018-11314
Published: 2018-07-03
Description: The External Control API in Roku and Roku TV products allow unauthorized access via a DNS Rebind attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20
References: https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325; https://support.roku.com/article/[PII_REDACTED]879; https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability
CVE: CVE-2018-11316
Published: 2018-07-03
Description: The UPnP HTTP server on Sonos wireless speaker products allow unauthorized access via a DNS rebinding attack. This can result in remote device control and privileged device and network information to be exfiltrated by an attacker.
CVSS Score: 9.6 (CRITICAL)
CWE: CWE-20
References: https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325; https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability; https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
CVE: CVE-2018-13102
Published: 2018-07-03
Description: AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-426
References: https://download.anydesk.com/changelog.txt; https://download.anydesk.com/changelog.txt
CVE: CVE-2018-13106
Published: 2018-07-03
Description: ClipperCMS 1.3.3 has stored XSS via the "Tools -> Configuration" screen of the manager/ URI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ClipperCMS/ClipperCMS/issues/489; https://github.com/ClipperCMS/ClipperCMS/issues/489
CVE: CVE-2018-11051
Published: 2018-07-03
Description: RSA Certificate Manager Versions 6.9 build 560 through 6.9 build 564 contain a path traversal vulnerability in the RSA CMP Enroll Server and the RSA REST Enroll Server. A remote unauthenticated attacker could potentially exploit this vulnerability by manipulating input parameters of the application to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://seclists.org/fulldisclosure/2018/Jul/11; http://www.securityfocus.com/bid/104674; http://www.securitytracker.com/id/1041211
CVE: CVE-2018-11052
Published: 2018-07-03
Description: Dell EMC ECS versions 3.2.0.0 and 3.2.0.1 contain an authentication bypass vulnerability. A remote unauthenticated attacker could exploit this vulnerability to read and modify S3 objects by supplying specially crafted S3 requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: http://seclists.org/fulldisclosure/2018/Jul/1; http://www.securityfocus.com/bid/104660; http://seclists.org/fulldisclosure/2018/Jul/1
CVE: CVE-2018-11634
Published: 2018-07-03
Description: Plaintext Storage of Passwords in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows local users to access the web application's user passwords in cleartext by reading /var/www/xms/xmsdb/default.db.
CVSS Score: 7.8 (HIGH)
CWE: CWE-522
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11635
Published: 2018-07-03
Description: Use of a Hard-coded Cryptographic Key used to protect cookie session data in /var/www/xms/application/config/config.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to bypass authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11636
Published: 2018-07-03
Description: Cross-site request forgery (CSRF) vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to execute malicious and unauthorized actions.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11637
Published: 2018-07-03
Description: Information leakage vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to read arbitrary files from the /var/ directory because a symlink exists under the web root.
CVSS Score: 7.5 (HIGH)
CWE: CWE-59
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11638
Published: 2018-07-03
Description: Unrestricted Upload of a File with a Dangerous Type in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to upload malicious code to the web root to gain code execution.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11639
Published: 2018-07-03
Description: Plaintext Storage of Passwords within Cookies in /var/www/xms/application/controllers/verifyLogin.php in the administrative console in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to access a user's password in cleartext.
CVSS Score: 8.1 (HIGH)
CWE: CWE-522
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11640
Published: 2018-07-03
Description: XML External Entity (XXE) vulnerability in the web service in Dialogic PowerMedia XMS before 3.5 SU2 allows remote attackers to read arbitrary files or cause a denial of service (resource consumption).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11641
Published: 2018-07-03
Description: Use of Hard-coded Credentials in /var/www/xms/application/controllers/gatherLogs.php in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote attackers to interact with a web service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11642
Published: 2018-07-03
Description: Incorrect Permission Assignment on the /var/www/xms/cleanzip.sh shell script run periodically in Dialogic PowerMedia XMS through 3.5 allows local users to execute code as the root user.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-11643
Published: 2018-07-03
Description: SQL injection vulnerability in the administrative console in Dialogic PowerMedia XMS through 3.5 allows remote authenticated users to execute arbitrary SQL commands via the filterPattern parameter.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://d3adend.org/blog/?p=1398; https://d3adend.org/blog/?p=1398
CVE: CVE-2018-13112
Published: 2018-07-03
Description: get_l2len in common/get.c in Tcpreplay 4.3.0 beta1 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packets, as demonstrated by tcpprep.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://github.com/appneta/tcpreplay/issues/477; https://github.com/appneta/tcpreplay/issues/477
CVE: CVE-2018-13113
Published: 2018-07-03
Description: The transfer and transferFrom functions of a smart contract implementation for Easy Trading Token (ETT), an Ethereum token, have an integer overflow. NOTE: this has been disputed by a third party.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: https://github.com/safecomet/EtherTokens/tree/master/Easy%20Trading%20Token%20%28ETT%29; https://github.com/soohoio/VeriSmartBench/wiki/CVE-False-Reported-Case; https://github.com/safecomet/EtherTokens/tree/master/Easy%20Trading%20Token%20%28ETT%29
CVE: CVE-2017-1250
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force 124630.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/124630; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/124630
CVE: CVE-2017-1275
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124750.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/124750; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/124750
CVE: CVE-2017-1277
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124752.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/124752; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/124752
CVE: CVE-2017-1280
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124758.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/124758; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/124758
CVE: CVE-2017-1281
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124759.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/124759; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/124759
CVE: CVE-2017-1293
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125154.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125154; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125154
CVE: CVE-2017-1294
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125155.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125155; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125155
CVE: CVE-2017-1299
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125161.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125161; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125161
CVE: CVE-2017-1306
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125460.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125460; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125460
CVE: CVE-2017-1312
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125723.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125723; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125723
CVE: CVE-2017-1313
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125724.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125724; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125724
CVE: CVE-2017-1314
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125725.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125725; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125725
CVE: CVE-2017-1315
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125727.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125727; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125727
CVE: CVE-2017-1316
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125728.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125728; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125728
CVE: CVE-2017-1317
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125729.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/125729; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/125729
CVE: CVE-2017-1561
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131760.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/131760; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/131760
CVE: CVE-2017-1562
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131761.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/131761; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/131761
CVE: CVE-2017-1564
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131764.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/131764; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/131764
CVE: CVE-2017-1565
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131765.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/131765; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/131765
CVE: CVE-2017-1568
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 131778.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/131778; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/131778
CVE: CVE-2017-1592
Published: 2018-07-03
Description: IBM Rational Quality Manager and IBM Rational Collaborative Lifecycle Management 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 132493.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/132493; https://www-prd-trops.events.ibm.com/node/715749; https://exchange.xforce.ibmcloud.com/vulnerabilities/132493