deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-6541
Published: 2018-02-02
Description: In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVSS Score: 6.5 (MEDIUM)
References: https://access.redhat.com/errata/RHSA-2019:2196; https://github.com/gdraheim/zziplib/issues/16; https://lists.debian.org/debian-lts-announce/2020/06/msg00029.html
CVE: CVE-2018-6542
Published: 2018-02-02
Description: In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.
CVSS Score: 6.5 (MEDIUM)
References: https://github.com/gdraheim/zziplib/issues/17; https://github.com/gdraheim/zziplib/issues/17
CVE: CVE-2018-6543
Published: 2018-02-02
Description: In GNU Binutils 2.30, there's an integer overflow in the function load_specific_debug_section() in objdump.c, which results in `malloc()` with 0 size. A crafted ELF file allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00072.html; http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00008.html; http://www.securityfocus.com/bid/102985
CVE: CVE-2018-6544
Published: 2018-02-02
Description: pdf_load_obj_stm in pdf/pdf-xref.c in Artifex MuPDF 1.12.0 could reference the object stream recursively and therefore run out of error stack, which allows remote attackers to cause a denial of service via a crafted PDF document.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-674
References: http://git.ghostscript.com/?p=mupdf.git%3Bh=26527eef77b3e51c2258c8e40845bfbc015e405d; http://git.ghostscript.com/?p=mupdf.git%3Bh=b03def134988da8c800adac1a38a41a1f09a1d89; https://bugs.ghostscript.com/show_bug.cgi?id=698830
CVE: CVE-2018-6545
Published: 2018-02-02
Description: Ipswitch MoveIt v8.1 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability, as demonstrated by human.aspx. Attackers can leverage this vulnerability to send malicious messages to other users in order to steal session cookies and launch client-side attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://crowdshield.com/blog.php?name=ipswitch-moveit-stored-xss; https://crowdshield.com/blog.php?name=ipswitch-moveit-stored-xss
CVE: CVE-2018-6548
Published: 2018-02-02
Description: A use-after-free issue was discovered in libwebm through 2018-02-02. If a Vp9HeaderParser was initialized once before, its property frame_ would not be changed because of code in vp9parser::Vp9HeaderParser::SetFrame. Its frame_ could be freed while the corresponding pointer would not be updated, leading to a dangling pointer. This is related to the function OutputCluster in webm_info.cc.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: https://bugs.chromium.org/p/webm/issues/detail?id=1493; https://github.com/dwfault/PoCs/blob/master/libwebm%20Vp9HeaderParser%20UAF%20by%20PrintVP9Info/libwebm%20Vp9HeaderParser%20UAF%20by%20PrintVP9Info.md; https://bugs.chromium.org/p/webm/issues/detail?id=1493
CVE: CVE-2018-6550
Published: 2018-02-02
Description: Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/monstra-cms/monstra/commit/388ab[PII_REDACTED]68758df6b07e7e06852f3747b; https://github.com/monstra-cms/monstra/issues/427; https://github.com/monstra-cms/monstra/commit/388ab[PII_REDACTED]68758df6b07e7e06852f3747b
CVE: CVE-2017-14177
Published: 2018-02-02
Description: Apport through 2.20.7 does not properly handle core dumps from setuid binaries allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-1324.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171; https://launchpad.net/bugs/1726372; https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14177
CVE: CVE-2017-14178
Published: 2018-02-02
Description: In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to call journalctl without match arguments and therefore allow unprivileged, unauthenticated users to bypass systemd-journald's access restrictions.
CVSS Score: 7.5 (HIGH)
CWE: CWE-755
References: https://github.com/snapcore/snapd/pull/4194; https://launchpad.net/bugs/1730255; https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-14178.html
CVE: CVE-2017-14179
Published: 2018-02-02
Description: Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://launchpad.net/bugs/1726372; https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14179; https://launchpad.net/bugs/1726372
CVE: CVE-2017-14180
Published: 2018-02-02
Description: Apport 2.13 through 2.20.7 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion or possibly gain root privileges, a different vulnerability than CVE-2017-14179.
CVSS Score: 7.8 (HIGH)
CWE: CWE-400
References: https://bazaar.launchpad.net/~apport-hackers/apport/trunk/revision/3171; https://launchpad.net/bugs/1726372; https://people.canonical.com/~ubuntu-security/cve/?cve=CVE-2017-14180
CVE: CVE-2017-18034
Published: 2018-02-02
Description: The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CRUC-8161; https://jira.atlassian.com/browse/FE-6994; https://jira.atlassian.com/browse/CRUC-8161
CVE: CVE-2017-18035
Published: 2018-02-02
Description: The /rest/review-coverage-chart/1.0/data/<repository_name>/.json resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 was missing a permissions check, this allows remote attackers who do not have access to a particular repository to determine its existence and access review coverage statistics for it.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284, CWE-862
References: https://jira.atlassian.com/browse/CRUC-8163; https://jira.atlassian.com/browse/FE-6996; https://jira.atlassian.com/browse/CRUC-8163
CVE: CVE-2017-18036
Published: 2018-02-02
Description: The Github repository importer in Atlassian Bitbucket Server before version 5.3.0 allows remote attackers to determine if a service they could not otherwise reach has open ports via a Server Side Request Forgery (SSRF) vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-918, CWE-918
References: http://www.securityfocus.com/bid/102932; https://jira.atlassian.com/browse/BSERV-10591; http://www.securityfocus.com/bid/102932
CVE: CVE-2017-18037
Published: 2018-02-02
Description: The git repository tag rest resource in Atlassian Bitbucket Server from version 3.7.0 before 4.14.11 (the fixed version for 4.14.x), from version 5.0.0 before 5.0.9 (the fixed version for 5.0.x), from version 5.1.0 before 5.1.8 (the fixed version for 5.1.x), from version 5.2.0 before 5.2.6 (the fixed version for 5.2.x), from version 5.3.0 before 5.3.4 (the fixed version for 5.3.x), from version 5.4.0 before 5.4.2 (the fixed version for 5.4.x), from version 5.5.0 before 5.5.1 (the fixed version for 5.5.x) and before 5.6.0 allows remote attackers to read arbitrary files via a path traversal vulnerability through the name of a git tag.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://jira.atlassian.com/browse/BSERV-10595; https://jira.atlassian.com/browse/BSERV-10595
CVE: CVE-2017-18038
Published: 2018-02-02
Description: The repository settings resource in Atlassian Bitbucket Server before version 5.6.0 allows remote attackers to read the first line of arbitrary files via a path traversal vulnerability through the default branch name.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://jira.atlassian.com/browse/BSERV-10592; https://jira.atlassian.com/browse/BSERV-10592
CVE: CVE-2017-18039
Published: 2018-02-02
Description: The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103086; https://jira.atlassian.com/browse/JRASERVER-66719; http://www.securityfocus.com/bid/103086
CVE: CVE-2017-18040
Published: 2018-02-02
Description: The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103070; https://jira.atlassian.com/browse/BAM-19661; http://www.securityfocus.com/bid/103070
CVE: CVE-2017-18041
Published: 2018-02-02
Description: The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103071; https://jira.atlassian.com/browse/BAM-19662; http://www.securityfocus.com/bid/103071
CVE: CVE-2017-18042
Published: 2018-02-02
Description: The update user administration resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify user data including passwords via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.securityfocus.com/bid/103110; https://jira.atlassian.com/browse/BAM-19663; http://www.securityfocus.com/bid/103110
CVE: CVE-2017-18080
Published: 2018-02-02
Description: The saveConfigureSecurity resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to modify security settings via a Cross-site request forgery (CSRF) vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://jira.atlassian.com/browse/BAM-19664; https://jira.atlassian.com/browse/BAM-19664
CVE: CVE-2017-18081
Published: 2018-02-02
Description: The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103087; https://jira.atlassian.com/browse/BAM-19665; http://www.securityfocus.com/bid/103087
CVE: CVE-2017-18082
Published: 2018-02-02
Description: The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a branch.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/BAM-19666; https://jira.atlassian.com/browse/BAM-19666
CVE: CVE-2017-18083
Published: 2018-02-02
Description: The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of an uploaded file.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://jira.atlassian.com/browse/CONFSERVER-54903; https://jira.atlassian.com/browse/CONFSERVER-54903
CVE: CVE-2017-18084
Published: 2018-02-02
Description: The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the description of a macro.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103064; https://jira.atlassian.com/browse/CONFSERVER-54904; http://www.securityfocus.com/bid/103064
CVE: CVE-2017-18085
Published: 2018-02-02
Description: The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103062; https://jira.atlassian.com/browse/CONFSERVER-54905; http://www.securityfocus.com/bid/103062
CVE: CVE-2017-18086
Published: 2018-02-02
Description: Various resources in Atlassian Confluence Server before version 6.4.2 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuesURL parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/103061; https://jira.atlassian.com/browse/CONFSERVER-54907; http://www.securityfocus.com/bid/103061
CVE: CVE-2018-6486
Published: 2018-02-02
Description: XML External Entity (XXE) vulnerability in Micro Focus Fortify Audit Workbench (AWB) and Micro Focus Fortify Software Security Center (SSC), versions 16.10, 16.20, 17.10. This vulnerability could be exploited to allow a XML External Entity (XXE) injection.
CVSS Score: 7.3 (HIGH)
CWE: CWE-611
References: http://www.securityfocus.com/bid/102902; https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03083653; http://www.securityfocus.com/bid/102902
CVE: CVE-2018-6551
Published: 2018-02-02
Description: The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190, CWE-787
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://sourceware.org/bugzilla/show_bug.cgi?id=22774; https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=8e448310d74b283c5cd02b9ed7fb997b47bf9b22
CVE: CVE-2018-6560
Published: 2018-02-02
Description: In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because whitespace handling in the proxy is not identical to whitespace handling in the daemon.
CVSS Score: 8.8 (HIGH)
CWE: CWE-436
References: https://access.redhat.com/errata/RHSA-2018:2766; https://github.com/flatpak/flatpak/commit/52346bf187b5a7f1c0fe9075b328b7ad6abe78f6; https://github.com/flatpak/flatpak/releases/tag/0.10.3
CVE: CVE-2017-18121
Published: 2018-02-02
Description: The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html; https://simplesamlphp.org/security/201709-01; https://www.debian.org/security/2018/dsa-4127
CVE: CVE-2017-18122
Published: 2018-02-02
Description: A signature-validation bypass issue was discovered in SimpleSAMLphp through 1.14.16. A SimpleSAMLphp Service Provider using SAML 1.1 will regard as valid any unsigned SAML response containing more than one signed assertion, provided that the signature of at least one of the assertions is valid. Attributes contained in all the assertions received will be merged and the entityID of the first assertion received will be used, allowing an attacker to impersonate any user of any IdP given an assertion signed by the targeted IdP.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html; https://simplesamlphp.org/security/201710-01; https://www.debian.org/security/2018/dsa-4127
CVE: CVE-2017-5727
Published: 2018-02-02
Description: Pointer dereference in subsystem in Intel Graphics Driver 15.40.x.x, 15.45.x.x, 15.46.x.x allows unprivileged user to elevate privileges via local access.
CVSS Score: 7.8 (HIGH)
CWE: CWE-476
References: https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00089&languageid=en-fr; https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00089&languageid=en-fr
CVE: CVE-2018-6561
Published: 2018-02-02
Description: dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/imsebao/404team/blob/master/dijit_editor_xss.md; https://github.com/imsebao/404team/blob/master/dijit_editor_xss.md
CVE: CVE-2018-6575
Published: 2018-02-02
Description: SQL Injection exists in the JEXTN Classified 1.0.0 component for Joomla! via a view=boutique&sid= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43957; https://www.exploit-db.com/exploits/43957
CVE: CVE-2018-6576
Published: 2018-02-02
Description: SQL Injection exists in Event Manager 1.0 via the event.php id parameter or the page.php slug parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43949; https://www.exploit-db.com/exploits/43949
CVE: CVE-2018-6577
Published: 2018-02-02
Description: SQL Injection exists in the JEXTN Membership 3.1.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43940; https://www.exploit-db.com/exploits/43940
CVE: CVE-2018-6578
Published: 2018-02-02
Description: SQL Injection exists in the JE PayperVideo 3.0.0 component for Joomla! via the usr_plan parameter in a view=myplans&task=myplans.usersubscriptions request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43948; https://www.exploit-db.com/exploits/43948
CVE: CVE-2018-6579
Published: 2018-02-02
Description: SQL Injection exists in the JEXTN Reverse Auction 3.1.0 component for Joomla! via a view=products&uid= request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43950; https://www.exploit-db.com/exploits/43950
CVE: CVE-2018-6580
Published: 2018-02-02
Description: Arbitrary file upload exists in the Jimtawl 2.1.6 and 2.2.5 component for Joomla! via a view=upload&task=upload&pop=true&tmpl=component request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://www.exploit-db.com/exploits/43958; https://www.exploit-db.com/exploits/43958
CVE: CVE-2018-6581
Published: 2018-02-02
Description: SQL Injection exists in the JMS Music 1.1.1 component for Joomla! via a search with the keyword, artist, or username parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.exploit-db.com/exploits/43959; https://www.exploit-db.com/exploits/43959
CVE: CVE-2014-1834
Published: 2018-02-02
Description: The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: http://www.openwall.com/lists/oss-security/2014/01/31/10; http://www.openwall.com/lists/oss-security/2014/01/31/10
CVE: CVE-2014-1835
Published: 2018-02-02
Description: The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
CVSS Score: 7.8 (HIGH)
CWE: CWE-255
References: http://www.openwall.com/lists/oss-security/2014/01/31/10; http://xforce.iss.net/xforce/xfdb/90858; http://www.openwall.com/lists/oss-security/2014/01/31/10
CVE: CVE-2015-2796
Published: 2018-02-02
Description: Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/Project-Pier/ProjectPier-Core/commit/74ecbd4e939a65ba643a4af05fbdb1bb66992435; https://github.com/Project-Pier/ProjectPier-Core/issues/37; https://github.com/Project-Pier/ProjectPier-Core/commit/74ecbd4e939a65ba643a4af05fbdb1bb66992435
CVE: CVE-2016-0300
Published: 2018-02-02
Description: IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 might allow remote attackers to access arbitrary JSP pages via vectors related to improper input validation. IBM X-Force ID: 111412.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg21979760; https://exchange.xforce.ibmcloud.com/vulnerabilities/111412; http://www-01.ibm.com/support/docview.wss?uid=swg21979760
CVE: CVE-2016-0303
Published: 2018-02-02
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21981591; http://www-01.ibm.com/support/docview.wss?uid=swg21981591
CVE: CVE-2016-0311
Published: 2018-02-02
Description: Cross-site scripting (XSS) vulnerability in IBM Tivoli Business Service Manager 6.1.0 before 6.1.0-TIV-BSM-FP0004 and 6.1.1 before 6.1.1-TIV-BSM-FP0004 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 111480.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21986853; https://exchange.xforce.ibmcloud.com/vulnerabilities/111480; https://www.ibm.com/blogs/psirt/ibm-security-bulletin-cross-site-scripting-vulnerability-in-tivoli-business-service-manager-cve-2016-0311/
CVE: CVE-2016-0312
Published: 2018-02-02
Description: IBM TRIRIGA Application Platform before 3.3.2 allows remote attackers to obtain sensitive information via vectors related to granting unauthenticated access to Document Manager. IBM X-Force ID: 111486.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www-01.ibm.com/support/docview.wss?uid=swg21979762; https://exchange.xforce.ibmcloud.com/vulnerabilities/111486; http://www-01.ibm.com/support/docview.wss?uid=swg21979762
CVE: CVE-2016-0329
Published: 2018-02-02
Description: Open redirect vulnerability in IBM Emptoris Sourcing 10.0.0.x before 10.0.0.1_iFix3, 10.0.1.x before 10.0.1.3_iFix3, 10.0.2.x before 10.0.2.8_iFix1, 10.0.4.0 before 10.0.4.0_iFix8, and 10.1.0.0 before 10.1.0.0_iFix3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 111692.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-601
References: http://www-01.ibm.com/support/docview.wss?uid=swg21982629; https://exchange.xforce.ibmcloud.com/vulnerabilities/111692; http://www-01.ibm.com/support/docview.wss?uid=swg21982629
CVE: CVE-2016-0342
Published: 2018-02-02
Description: IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.3, and 3.5 before 3.5.0.1 allows remote authenticated users to read or modify arbitrary reports by leveraging an incorrect grant of access. IBM X-Force ID: 111783.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-284
References: http://www-01.ibm.com/support/docview.wss?uid=swg21980252; https://exchange.xforce.ibmcloud.com/vulnerabilities/111783; http://www-01.ibm.com/support/docview.wss?uid=swg21980252