deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-10502
Published: 2018-09-24
Description: This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of a staging mode. The issue lies in the ability to change the configuration based on the presence of a file in an user-controlled location. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5359.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-18-560; https://zerodayinitiative.com/advisories/ZDI-18-560
CVE: CVE-2018-11614
Published: 2018-09-24
Description: This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Intents. The issue lies in the ability to send an Intent that would not otherwise be reachable. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the application. Was ZDI-CAN-5361.
CVSS Score: 8.8 (HIGH)
CWE: CWE-269
References: https://zerodayinitiative.com/advisories/ZDI-18-562; https://zerodayinitiative.com/advisories/ZDI-18-562
CVE: CVE-2018-14318
Published: 2018-09-24
Description: This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of IPCP headers. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code under the context of the baseband processor. Was ZDI-CAN-5368.
CVSS Score: 8.8 (HIGH)
CWE: CWE-121, CWE-20
References: https://zerodayinitiative.com/advisories/ZDI-18-1077; https://zerodayinitiative.com/advisories/ZDI-18-1077
CVE: CVE-2018-14633
Published: 2018-09-25
Description: A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The attack requires the iSCSI target to be enabled on the victim host. Depending on how the target's code was built (i.e. depending on a compiler, compile flags and hardware architecture) an attack may lead to a system crash and thus to a denial-of-service or possibly to a non-authorized access to data exported by an iSCSI target. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is highly unlikely. Kernel versions 4.18.x, 4.14.x and 3.10.x are believed to be vulnerable.
CVSS Score: 7.0 (HIGH)
CWE: CWE-121, CWE-787
References: http://www.securityfocus.com/bid/105388; https://access.redhat.com/errata/RHSA-2018:3651; https://access.redhat.com/errata/RHSA-2018:3666
CVE: CVE-2018-14647
Published: 2018-09-25
Description: Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by constructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming large amounts CPU and RAM. The vulnerability exists in Python versions 3.7.0, 3.6.0 through 3.6.6, 3.5.0 through 3.5.6, 3.4.0 through 3.4.9, 2.7.0 through 2.7.15.
CVSS Score: 7.5 (HIGH)
CWE: CWE-335, CWE-665, CWE-909
References: http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html; http://www.securityfocus.com/bid/105396; http://www.securitytracker.com/id/1041740
CVE: CVE-2018-12775
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12778
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12801
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12840
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12848
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: http://www.securityfocus.com/bid/105360; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12849
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-12850
Published: 2018-09-25
Description: Adobe Acrobat and Reader versions 2[PII_REDACTED]8 and earlier, 2[PII_REDACTED]9 and earlier, and 2[PII_REDACTED]8 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/105358; http://www.securitytracker.com/id/1041702; https://helpx.adobe.com/security/products/acrobat/apsb18-34.html
CVE: CVE-2018-15957
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/105313; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15958
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/105313; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15959
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/105313; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15960
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to arbitrary file overwrite.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105317; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15961
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-434
References: http://www.securityfocus.com/bid/105314; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15962
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a directory listing vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105318; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15963
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary folder creation.
CVSS Score: 5.3 (MEDIUM)
References: http://www.securityfocus.com/bid/105310; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15964
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a use of a component with a known vulnerability vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/105311; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15965
Published: 2018-09-25
Description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have a deserialization of untrusted data vulnerability. Successful exploitation could lead to arbitrary code execution.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-502, CWE-502
References: http://www.securityfocus.com/bid/105313; http://www.securitytracker.com/id/1041621; https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
CVE: CVE-2018-15967
Published: 2018-09-25
Description: Adobe Flash Player versions 30.0.0.154 and earlier have a privilege escalation vulnerability. Successful exploitation could lead to information disclosure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/105315; http://www.securitytracker.com/id/1041620; https://access.redhat.com/errata/RHSA-2018:2707
CVE: CVE-2018-6031
Published: 2018-09-25
Description: Use after free in PDFium in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6032
Published: 2018-09-25
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6033
Published: 2018-09-25
Description: Insufficient data validation in Downloads in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6034
Published: 2018-09-25
Description: Insufficient data validation in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 8.1 (HIGH)
CWE: CWE-125
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6035
Published: 2018-09-25
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6036
Published: 2018-09-25
Description: Insufficient data validation in V8 in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user data via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6037
Published: 2018-09-25
Description: Inappropriate implementation in autofill in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain autofill data with insufficient user gestures via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6038
Published: 2018-09-25
Description: Heap buffer overflow in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119, CWE-125
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6039
Published: 2018-09-25
Description: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6040
Published: 2018-09-25
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially bypass content security policy via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-732
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6041
Published: 2018-09-25
Description: Incorrect security UI in navigation in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6042
Published: 2018-09-25
Description: Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6043
Published: 2018-09-25
Description: Insufficient data validation in External Protocol Handler in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially execute arbitrary programs on user machine via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6045
Published: 2018-09-25
Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user local file data via a crafted Chrome Extension.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6046
Published: 2018-09-25
Description: Insufficient data validation in DevTools in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user cross-origin data via a crafted Chrome Extension.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6047
Published: 2018-09-25
Description: Insufficient policy enforcement in WebGL in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak user redirect URL via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6048
Published: 2018-09-25
Description: Insufficient policy enforcement in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially leak referrer information via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6049
Published: 2018-09-25
Description: Incorrect security UI in permissions prompt in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the origin to which permission is granted via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6050
Published: 2018-09-25
Description: Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6051
Published: 2018-09-25
Description: XSS Auditor in Google Chrome prior to 64.0.3282.119, did not ensure the reporting URL was in the same origin as the page it was on, which allowed a remote attacker to obtain referrer details via a crafted HTML page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6052
Published: 2018-09-25
Description: Lack of support for a non standard no-referrer policy value in Blink in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to obtain referrer details from a web page that had thought it had opted out of sending referrer data.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6053
Published: 2018-09-25
Description: Inappropriate implementation in New Tab Page in Google Chrome prior to 64.0.3282.119 allowed a local attacker to view website thumbnail images after clearing browser data via a crafted HTML page.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6054
Published: 2018-09-25
Description: Use after free in WebUI in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/102797; http://www.securitytracker.com/id/1040282; https://access.redhat.com/errata/RHSA-2018:0265
CVE: CVE-2018-6055
Published: 2018-09-25
Description: Insufficient policy enforcement in Catalog Service in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to potentially run arbitrary code outside sandbox via a crafted HTML page.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105516; https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html; https://crbug.com/791003
CVE: CVE-2018-6119
Published: 2018-09-25
Description: Incorrect security UI in Omnibox in Google Chrome prior to 64.0.3282.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/105512; https://chromereleases.googleblog.com/2018/01/stable-channel-update-for-desktop_24.html; https://crbug.com/784761
CVE: CVE-2018-1539
Published: 2018-09-25
Description: IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-287
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/142561; https://www.ibm.com/support/docview.wss?uid=ibm10731511; https://exchange.xforce.ibmcloud.com/vulnerabilities/142561
CVE: CVE-2018-1560
Published: 2018-09-25
Description: IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142958.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/142958; https://www.ibm.com/support/docview.wss?uid=ibm10731511; https://exchange.xforce.ibmcloud.com/vulnerabilities/142958