deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-14911
Published: 2018-08-03
Description: A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka "Allow upload file suffix") setting, and must use "php,php" in this setting to bypass the "php" restriction.
CVSS Score: 7.2 (HIGH)
CWE: CWE-434
References: https://github.com/yxcmf/ukcms/issues/1; https://github.com/yxcmf/ukcms/issues/1
CVE: CVE-2018-14912
Published: 2018-08-03
Description: cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://bugs.chromium.org/p/project-zero/issues/detail?id=1627; https://lists.debian.org/debian-lts-announce/2018/08/msg00005.html; https://lists.zx2c4.com/pipermail/cgit/2018-August/004176.html
CVE: CVE-2018-5490
Published: 2018-08-03
Description: Read-Only export policy rules are not correctly enforced in Clustered Data ONTAP 8.3 Release Candidate versions and therefore may allow more than "read-only" access from authenticated SMBv2 and SMBv3 clients. This behavior has been resolved in the GA release. Customers running prior release candidates (RCs) are requested to update their systems to the NetApp Data ONTAP 8.3 GA release.
CVSS Score: 8.8 (HIGH)
CWE: CWE-732
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2018-14923
Published: 2018-08-03
Description: A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.cnvd.org.cn/flaw/show/1325763; http://www.cnvd.org.cn/flaw/show/1325763
CVE: CVE-2018-3777
Published: 2018-08-03
Description: Insufficient URI encoding in restforce before 3.0.0 allows attacker to inject arbitrary parameters into Salesforce API requests.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20, CWE-172
References: https://github.com/restforce/restforce/pull/392; https://github.com/restforce/restforce/pull/392
CVE: CVE-2018-9866
Published: 2018-08-03
Description: A vulnerability in lack of validation of user-supplied parameters pass to XML-RPC calls on SonicWall Global Management System (GMS) virtual appliance's, allow remote user to execute arbitrary code. This vulnerability affected GMS version 8.1 and earlier.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77, CWE-20
References: https://github.com/rapid7/metasploit-framework/pull/10305; https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0007; https://twitter.com/ddouhine/status/[PII_REDACTED]02586112
CVE: CVE-2018-14924
Published: 2018-08-03
Description: Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147963; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-14925
Published: 2018-08-03
Description: Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-209
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147964; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-14926
Published: 2018-08-03
Description: Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147965; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-14927
Published: 2018-08-03
Description: Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /contingency/servlet/ServletFileDownload file parameter, related to /contingency/web/receiptQuery/receiptDisplay.jsp.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147966; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-14928
Published: 2018-08-03
Description: /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147967; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-14929
Published: 2018-08-03
Description: Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9; https://exchange.xforce.ibmcloud.com/vulnerabilities/147968; https://medium.com/stolabs/security-issues-on-matera-systems-fba14d207dc9
CVE: CVE-2018-12482
Published: 2018-08-04
Description: OCS Inventory 2.4.1 contains multiple SQL injections in the search engine. Authentication is needed in order to exploit the issues.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/; https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE: CVE-2018-12483
Published: 2018-08-04
Description: OCS Inventory 2.4.1 is prone to a remote command-execution vulnerability. Specifically, this issue occurs because the content of the ipdiscover_analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. Authentication is needed in order to exploit this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/; https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE: CVE-2018-14417
Published: 2018-08-04
Description: A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary commands with root permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: http://seclists.org/fulldisclosure/2018/Jul/85; http://www.securityfocus.com/bid/104914; https://docs.softnas.com/display/SD/Release+Notes
CVE: CVE-2018-14473
Published: 2018-08-04
Description: OCS Inventory 2.4.1 lacks a proper XML parsing configuration, allowing the use of external entities. This issue can be exploited by an attacker sending a crafted HTTP request in order to exfiltrate information or cause a Denial of Service.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-611
References: https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/; https://www.tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1/
CVE: CVE-2018-14497
Published: 2018-08-04
Description: Tenda D152 ADSL routers allow XSS via a crafted SSID.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://sandipdeyhack7.blogspot.com/2018/07/cve-2018-14497-tenda-d152-adsl-routers_24.html; https://www.exploit-db.com/exploits/45336/; https://sandipdeyhack7.blogspot.com/2018/07/cve-2018-14497-tenda-d152-adsl-routers_24.html
CVE: CVE-2018-14541
Published: 2018-08-04
Description: PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name, Last name, Address 1, City, State, and Company name fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gkaim.com/cve-2018-14541-vikas-chaudhary/; https://www.exploit-db.com/exploits/45140/; https://gkaim.com/cve-2018-14541-vikas-chaudhary/
CVE: CVE-2018-14593
Published: 2018-08-04
Description: An issue was discovered in Open Ticket Request System (OTRS) 6.0.x through 6.0.9, 5.0.x through 5.0.28, and 4.0.x through 4.0.30. An attacker who is logged into OTRS as an agent may escalate their privileges by accessing a specially crafted URL.
CVSS Score: 8.8 (HIGH)
References: https://community.otrs.com/security-advisory-2018-03-security-update-for-otrs-framework/?lang=de; https://lists.debian.org/debian-lts-announce/2018/08/msg00021.html; https://www.debian.org/security/2018/dsa-4317
CVE: CVE-2018-14933
Published: 2018-08-04
Description: upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://www.exploit-db.com/exploits/45070/; https://www.exploit-db.com/exploits/46340/; https://www.exploit-db.com/exploits/45070/
CVE: CVE-2018-14936
Published: 2018-08-05
Description: The Add page option in my little forum 2.4.12 allows XSS via the Title field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://owendarlene.com/stored-xss-my-little-forum/; http://owendarlene.com/stored-xss-my-little-forum/
CVE: CVE-2018-14937
Published: 2018-08-05
Description: The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://owendarlene.com/stored-xss-my-little-forum/; http://owendarlene.com/stored-xss-my-little-forum/
CVE: CVE-2018-14938
Published: 2018-08-05
Description: An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during caplen processing. If the caplen is less than 144, one can cause an integer overflow in the function handle_80211, which will result in an out-of-bounds read and may allow access to sensitive memory (or a denial of service).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-125, CWE-190
References: https://github.com/simsong/tcpflow/commit/a4e1cd14eb5ccc51ed271b65b3420f7d692c40eb; https://github.com/simsong/tcpflow/issues/182; https://lists.debian.org/debian-lts-announce/2020/11/msg00046.html
CVE: CVE-2018-14939
Published: 2018-08-05
Description: The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remote web site.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/105047; https://bugs.documentfoundation.org/show_bug.cgi?id=118514; http://www.securityfocus.com/bid/105047
CVE: CVE-2018-14940
Published: 2018-08-05
Description: PHPCMS 9 allows remote attackers to cause a denial of service (resource consumption) via large font_size, height, and width parameters in an api.php?op=checkcode request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/m0us3Sun/PHPCMS-v9/issues/1; https://github.com/m0us3Sun/PHPCMS-v9/issues/1
CVE: CVE-2018-14941
Published: 2018-08-05
Description: Harmonic NSG 9000 devices allow remote authenticated users to read the webapp.py source code via a direct request for the /webapp.py URI.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: https://github.com/pudding2/NSG9000/blob/master/exp.txt; https://github.com/pudding2/NSG9000/blob/master/exp.txt
CVE: CVE-2018-14942
Published: 2018-08-05
Description: Harmonic NSG 9000 devices allow remote authenticated users to conduct directory traversal attacks, as demonstrated by "POST /PY/EMULATION_GET_FILE" or "POST /PY/EMULATION_EXPORT" with FileName=../../../passwd in the POST data.
CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://github.com/pudding2/NSG9000/blob/master/exp.txt; https://github.com/pudding2/NSG9000/blob/master/exp.txt
CVE: CVE-2018-14943
Published: 2018-08-05
Description: Harmonic NSG 9000 devices have a default password of nsgadmin for the admin account, a default password of nsgguest for the guest account, and a default password of nsgconfig for the config account.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-798
References: https://github.com/pudding2/NSG9000/blob/master/exp.txt; https://github.com/pudding2/NSG9000/blob/master/exp.txt
CVE: CVE-2018-14944
Published: 2018-08-05
Description: An issue has been found in jpeg_encoder through 2015-11-27. It is a SEGV in the function readFromBMP in jpeg_encoder.cpp. The signal is caused by an out-of-bounds write.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/fouzhe/security/tree/master/jpeg_encoder#segv-in-function-readfrombmp; https://github.com/thejinchao/jpeg_encoder/issues/4; https://github.com/fouzhe/security/tree/master/jpeg_encoder#segv-in-function-readfrombmp
CVE: CVE-2018-14945
Published: 2018-08-05
Description: An issue has been found in jpeg_encoder through 2015-11-27. It is a heap-based buffer overflow in the function readFromBMP in jpeg_encoder.cpp.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://github.com/fouzhe/security/tree/master/jpeg_encoder#heap-buffer-overflow-in-function-readfrombmp; https://github.com/thejinchao/jpeg_encoder/issues/6; https://github.com/fouzhe/security/tree/master/jpeg_encoder#heap-buffer-overflow-in-function-readfrombmp
CVE: CVE-2018-14946
Published: 2018-08-05
Description: An issue has been found in PDF2JSON 0.69. The HtmlString class in ImgOutputDev.cc has Mismatched Memory Management Routines (malloc versus operator delete).
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/flexpaper/pdf2json/issues/19; https://github.com/fouzhe/security/tree/master/pdf2json#alloc_dealloc_mismatch-in-function-htmlstring; https://github.com/flexpaper/pdf2json/issues/19
CVE: CVE-2018-14947
Published: 2018-08-05
Description: An issue has been found in PDF2JSON 0.69. XmlFontAccu::CSStyle in XmlFonts.cc has Mismatched Memory Management Routines (operator new [] versus operator delete).
CVSS Score: 8.8 (HIGH)
CWE: CWE-119
References: https://github.com/flexpaper/pdf2json/issues/20; https://github.com/fouzhe/security/tree/master/pdf2json#alloc_dealloc_mismatch-in-function-csstyle; https://github.com/flexpaper/pdf2json/issues/20
CVE: CVE-2018-14948
Published: 2018-08-05
Description: An issue has been found in dilawar sound through 2017-11-27. The end of openWavFile in wav-file.cc has Mismatched Memory Management Routines (operator new [] versus operator delete).
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://github.com/dilawar/sound/issues/4; https://github.com/fouzhe/security/tree/master/sound#alloc-dealloc-mismatch-in-function-openwavfile; https://github.com/dilawar/sound/issues/4
CVE: CVE-2018-14950
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<svg><a xlink:href=" attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14951
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<form action='data:text" attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14952
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math><maction xlink:href=" attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14953
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via a "<math xlink:href=" attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14954
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via the formaction attribute.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14955
Published: 2018-08-05
Description: The mail message display page in SquirrelMail through 1.4.22 has XSS via SVG animations (animate to attribute).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2018/07/26/2; https://bugs.debian.org/905023; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CVXTYMZ35IC5KPNMAE6BWAQWURMX7KZO/
CVE: CVE-2018-14958
Published: 2018-08-05
Description: An issue was discovered in WeaselCMS v0.3.5. CSRF can update the website settings (such as the theme, title, and description) via index.php.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/alterebro/WeaselCMS/issues/6; https://github.com/alterebro/WeaselCMS/issues/6
CVE: CVE-2018-14959
Published: 2018-08-05
Description: An issue was discovered in WeaselCMS v0.3.5. CSRF can create new pages via an index.php?b=pages&a=new URI.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/alterebro/WeaselCMS/issues/6; https://github.com/alterebro/WeaselCMS/issues/6
CVE: CVE-2017-12614
Published: 2018-08-06
Description: It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f%40%3Cdev.airflow.apache.org%3E; https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f%40%3Cdev.airflow.apache.org%3E
CVE: CVE-2017-1366
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-326
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/126859; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1368
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-384
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/126861; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1396
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342.
CVSS Score: 4.2 (MEDIUM)
CWE: CWE-275
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/127342; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1409
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/127396; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1411
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/127399; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1412
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/127400; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2017-1755
Published: 2018-08-06
Description: IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files that could be executed by the administrator. IBM X-Force ID: 135855.
CVSS Score: 6.5 (MEDIUM)
References: http://www.ibm.com/support/docview.wss?uid=swg22016869; https://exchange.xforce.ibmcloud.com/vulnerabilities/135855; http://www.ibm.com/support/docview.wss?uid=swg22016869
CVE: CVE-2018-1422
Published: 2018-08-06
Description: IBM Jazz Foundation products (IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.5) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139025.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.ibm.com/support/docview.wss?uid=ibm10719817; http://www.securityfocus.com/bid/105003; https://exchange.xforce.ibmcloud.com/vulnerabilities/139025
CVE: CVE-2018-1528
Published: 2018-08-06
Description: IBM Maximo Asset Management 7.6 through 7.6.3 could allow an authenticated user to obtain sensitive information from the WhoAmI API. IBM X-Force ID: 142290.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105023; https://exchange.xforce.ibmcloud.com/vulnerabilities/142290; https://www.ibm.com/support/docview.wss?uid=swg22017450