deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that can result in local code execution as a different user. This attack appear to be exploitable via using the --plugin flag without the --plugin-path flag. This vulnerability appears to have been fixed in 1.27.1.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00076.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00031.html
CVE: CVE-2[PII_REDACTED]
Published: 2018-07-09
Description: JFrog JFrog Artifactory version Prior to version 6.0.3, since version 4.0.0 contains a Directory Traversal vulnerability in The "Import Repository from Zip" feature, available through the Admin menu -> Import & Export -> Repositories, triggers a vulnerable UI REST endpoint (/ui/artifactimport/upload) that can result in Directory traversal / file overwrite and remote code execution. This attack appear to be exploitable via An attacker with Admin privileges may use the aforementioned UI endpoint and exploit the publicly known "Zip Slip" vulnerability, to add/overwrite files outside the target directory. This vulnerability appears to have been fixed in 6.0.3.
CVSS Score: 7.2 (HIGH)
CWE: CWE-22
References: https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.0.3; https://www.jfrog.com/confluence/display/RTF/Release+Notes#ReleaseNotes-Artifactory6.0.3
CVE: CVE-2018-11450
Published: 2018-07-09
Description: A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker, the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/LucvanDonk/Siemens-Siemens-PLM-Software-TEAMCENTER-Reflected-Cross-Site-Scripting-XSS-vulnerability/wiki; https://github.com/LucvanDonk/Siemens-Siemens-PLM-Software-TEAMCENTER-Reflected-Cross-Site-Scripting-XSS-vulnerability/wiki
CVE: CVE-2018-13790
Published: 2018-07-09
Description: A Server Side Request Forgery (SSRF) vulnerability in tools/files/importers/remote.php in concrete5 8.2.0 can lead to attacks on the local network and mapping of the internal network, because of URL functionality on the File Manager page.
CVSS Score: 7.2 (HIGH)
CWE: CWE-918
References: https://hackerone.com/reports/243865; https://hackerone.com/reports/243865
CVE: CVE-2018-6965
Published: 2018-07-09
Description: VMware ESXi (6.7 before ESXi[PII_REDACTED]01-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6966 and CVE-2018-6967.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104709; http://www.securitytracker.com/id/1041208; https://www.vmware.com/security/advisories/VMSA-2018-0016.html
CVE: CVE-2018-6966
Published: 2018-07-09
Description: VMware ESXi (6.7 before ESXi[PII_REDACTED]01-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6967.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104709; http://www.securitytracker.com/id/1041208; https://www.vmware.com/security/advisories/VMSA-2018-0016.html
CVE: CVE-2018-6967
Published: 2018-07-09
Description: VMware ESXi (6.7 before ESXi[PII_REDACTED]01-BG), Workstation (14.x before 14.1.2), and Fusion (10.x before 10.1.2) contain an out-of-bounds read vulnerability in the shader translator. Successful exploitation of this issue may lead to information disclosure or may allow attackers with normal user privileges to crash their VMs, a different vulnerability than CVE-2018-6965 and CVE-2018-6966.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/104709; http://www.securitytracker.com/id/1041208; https://www.vmware.com/security/advisories/VMSA-2018-0016.html
CVE: CVE-2018-13791
Published: 2018-07-09
Description: The HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 allows an attacker to conduct Access Control attacks via the /FlexiCapture12/Login/Server/SevaUserProfile FlexiCaptureTmsSts2 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-732
References: http://abbyydownloads.com/fc12/PreviousReleaseNotes/ReleaseNotes_FC12_R1_U3_1299.18_build_12.0.1.516.pdf; http://abbyydownloads.com/fc12/PreviousReleaseNotes/ReleaseNotes_FC12_R1_U3_1299.18_build_12.0.1.516.pdf
CVE: CVE-2018-13793
Published: 2018-07-09
Description: Multiple Cross Site Request Forgery (CSRF) vulnerabilities in the HTTP API in ABBYY FlexiCapture before 12 Release 1 Update 7 exist in Web Verification, Web Scanning, Web Capture, Monitoring and Administration, and Login.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://abbyydownloads.com/fc12/PreviousReleaseNotes/ReleaseNotes_FC12_R1_U3_1299.18_build_12.0.1.516.pdf; http://abbyydownloads.com/fc12/PreviousReleaseNotes/ReleaseNotes_FC12_R1_U3_1299.18_build_12.0.1.516.pdf
CVE: CVE-2018-13794
Published: 2018-07-09
Description: A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://github.com/posva/catimg/issues/34; https://github.com/posva/catimg/issues/34
CVE: CVE-2018-13795
Published: 2018-07-09
Description: Gravity before 0.5.1 does not support a maximum recursion depth.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://github.com/marcobambini/gravity/issues/237; https://github.com/marcobambini/gravity/issues/237
CVE: CVE-2016-10726
Published: 2018-07-10
Description: The XMLUI feature in DSpace before 3.6, 4.x before 4.5, and 5.x before 5.5 allows directory traversal via the themes/ path in an attack with two or more arbitrary characters and a colon before a pathname, as demonstrated by a themes/Reference/aa:etc/passwd URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/DSpace/DSpace/releases/tag/dspace-5.5; https://jira.duraspace.org/browse/DS-3094; https://wiki.duraspace.org/display/DSDOC5x/Release+Notes
CVE: CVE-2018-12230
Published: 2018-07-10
Description: An wrong logical check identified in the transferFrom function of a smart contract implementation for RemiCoin (RMC), an Ethereum ERC20 token, allows the attacker to steal tokens or conduct resultant integer underflow attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-191
References: https://docs.google.com/document/d/1_Q3rglY4FkRCGhFm4V8N1A8HSoq4fYW6bOPlgkuWmZc/edit?usp=sharing; https://docs.google.com/document/d/1_Q3rglY4FkRCGhFm4V8N1A8HSoq4fYW6bOPlgkuWmZc/edit?usp=sharing
CVE: CVE-2018-13797
Published: 2018-07-10
Description: The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/scravy/node-macaddress/commit/358fd594adb196a86b94ac9c691f69fe5dad2332; https://github.com/scravy/node-macaddress/pull/20/; https://github.com/scravy/node-macaddress/releases/tag/0.2.9
CVE: CVE-2018-1337
Published: 2018-07-10
Description: In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-200
References: http://www.securityfocus.com/bid/104744; https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.apache.org%3E; https://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apache.org%3E
CVE: CVE-2018-13388
Published: 2018-07-10
Description: The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/104717; https://jira.atlassian.com/browse/CRUC-8209; https://jira.atlassian.com/browse/FE-7059
CVE: CVE-2018-13389
Published: 2018-07-10
Description: The attachment resource in Atlassian Confluence before version 6.6.1 allows remote attackers to spoof web content in the Mozilla Firefox Browser through attachments that have a content-type of application/rdf+xml.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/104755; https://jira.atlassian.com/browse/CONFSERVER-54906; http://www.securityfocus.com/bid/104755
CVE: CVE-2018-10861
Published: 2018-07-10
Description: A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
CVSS Score: 8.1 (HIGH)
CWE: CWE-285, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html; http://tracker.ceph.com/issues/24838; http://www.securityfocus.com/bid/104742
CVE: CVE-2018-10887
Published: 2018-07-10
Description: A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
CVSS Score: 8.1 (HIGH)
CWE: CWE-194, CWE-125, CWE-190, CWE-681
References: https://bugzilla.redhat.com/show_bug.cgi?id=1598021; https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a; https://github.com/libgit2/libgit2/commit/c[PII_REDACTED]b701dcbcf9439ac225ea851b47d22
CVE: CVE-2018-10888
Published: 2018-07-10
Description: A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20, CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1598024; https://github.com/libgit2/libgit2/commit/9844d38bed10e9ff17174434b3421b227ae710f3; https://github.com/libgit2/libgit2/releases/tag/v0.27.3
CVE: CVE-2018-1128
Published: 2018-07-10
Description: It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker having access to ceph cluster network who is able to sniff packets on network can use this vulnerability to authenticate with ceph service and perform actions allowed by ceph service. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Score: 7.5 (HIGH)
CWE: CWE-294, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html; http://tracker.ceph.com/issues/24836; http://www.openwall.com/lists/oss-security/2020/11/17/3
CVE: CVE-2018-1129
Published: 2018-07-10
Description: A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster network who is able to alter the message payload was able to bypass signature checks done by cephx protocol. Ceph branches master, mimic, luminous and jewel are believed to be vulnerable.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-287
References: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.html; http://packetstormsecurity.com/files/154245/Kernel-Live-Patch-Security-Notice-LSN-0054-1.html; http://tracker.ceph.com/issues/24837
CVE: CVE-2018-13818
Published: 2018-07-10
Description: Twig before 2.4.4 allows Server-Side Template Injection (SSTI) via the search search_key parameter. NOTE: the vendor points out that Twig itself is not a web application and states that it is the responsibility of web applications using Twig to properly wrap input to it
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/twigphp/Twig/blob/2.x/CHANGELOG; https://github.com/twigphp/Twig/commit/eddb97148ad779f27e670e1e3f19fb323aedafeb; https://github.com/twigphp/Twig/issues/2743
CVE: CVE-2018-9853
Published: 2018-07-10
Description: Insecure access control in freeSSHd version 1.3.1 allows attackers to obtain the privileges of the freesshd.exe process by leveraging the ability to login to an unprivileged account on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-269
References: https://medium.com/%40TheWindowsTwin/vulnerability-in-freesshd-5a0abc147d7a; https://medium.com/%40TheWindowsTwin/vulnerability-in-freesshd-5a0abc147d7a
CVE: CVE-2018-10943
Published: 2018-07-10
Description: An issue was discovered on Barco ClickShare CSE-200 and CS-100 Base Units with firmware before 1.6.0.3. Sending an arbitrary unexpected string to TCP port 7100 respecting a certain frequency timing disconnects all clients and results in a crash of the Unit.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=06&patchVersion=00&buildVersion=003; https://www.barco.com/en/support/software/R33050070?majorVersion=01&minorVersion=06&patchVersion=00&buildVersion=003; https://www.barco.com/en/support/software/R33050069?majorVersion=01&minorVersion=06&patchVersion=00&buildVersion=003
CVE: CVE-2018-13833
Published: 2018-07-10
Description: An issue was discovered in cmft through 2017-09-24. The cmft::rwReadFile function in image.cpp allows remote attackers to cause a denial of service (stack-based buffer overflow and application crash) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/dariomanesku/cmft/issues/38; https://github.com/fouzhe/security/tree/master/cmft; https://github.com/dariomanesku/cmft/issues/38
CVE: CVE-2018-1407
Published: 2018-07-10
Description: IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138445.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/138445; https://www.ibm.com/support/docview.wss?uid=ibm10716507; https://exchange.xforce.ibmcloud.com/vulnerabilities/138445
CVE: CVE-2018-1408
Published: 2018-07-10
Description: IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138446.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/138446; https://www.ibm.com/support/docview.wss?uid=ibm10716507; https://exchange.xforce.ibmcloud.com/vulnerabilities/138446
CVE: CVE-2018-1521
Published: 2018-07-10
Description: IBM Rational Team Concert 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141802.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/141802; https://www.ibm.com/support/docview.wss?uid=ibm10716507; https://exchange.xforce.ibmcloud.com/vulnerabilities/141802
CVE: CVE-2017-1729
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 134909.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/134909; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2017-1738
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 contains an undisclosed vulnerability that would allow an authenticated user to obtain elevated privileges. IBM X-Force ID: 134919.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/134919; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2017-1791
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137036.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/137036; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2017-1792
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137037.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/137037; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2017-1793
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137038.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/137038; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2018-1396
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 138429.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/138429; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2018-1423
Published: 2018-07-10
Description: IBM Jazz Foundation products could disclose sensitive information to an authenticated attacker that could be used in further attacks against the system. IBM X-Force ID: 139026.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=ibm10716599; https://exchange.xforce.ibmcloud.com/vulnerabilities/139026; http://www.ibm.com/support/docview.wss?uid=ibm10716599
CVE: CVE-2018-1458
Published: 2018-07-10
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209.
CVSS Score: 7.4 (HIGH)
CWE: CWE-426
References: http://www.securitytracker.com/id/1041230; https://exchange.xforce.ibmcloud.com/vulnerabilities/140209; https://www.ibm.com/support/docview.wss?uid=swg22016624
CVE: CVE-2018-1487
Published: 2018-07-10
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege users full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 140972.
CVSS Score: 8.4 (HIGH)
CWE: CWE-426
References: http://www.ibm.com/support/docview.wss?uid=swg22016505; http://www.securitytracker.com/id/1041231; https://exchange.xforce.ibmcloud.com/vulnerabilities/140972
CVE: CVE-2018-1492
Published: 2018-07-10
Description: IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to properly log out from the previous session. IBM X-Force ID: 140977.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=ibm10716599; https://exchange.xforce.ibmcloud.com/vulnerabilities/140977; http://www.ibm.com/support/docview.wss?uid=ibm10716599
CVE: CVE-2018-1523
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141804.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/141804; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2018-1549
Published: 2018-07-10
Description: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning, cross-site scripting, and possibly obtain sensitive information. IBM X-Force ID: 142658.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-74
References: http://www.ibm.com/support/docview.wss?uid=ibm10716607; https://exchange.xforce.ibmcloud.com/vulnerabilities/142658; http://www.ibm.com/support/docview.wss?uid=ibm10716607
CVE: CVE-2018-1566
Published: 2018-07-10
Description: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023.
CVSS Score: 8.4 (HIGH)
CWE: CWE-134
References: http://www.ibm.com/support/docview.wss?uid=swg22016182; http://www.securityfocus.com/bid/104740; http://www.securitytracker.com/id/1041229