rainbutterfly/cve_corpus huggingface dataset:
CVE-2018-1640 
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 144580.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Security Privileged Identity Manager
Published: 2019-04-02T13:20:33.751Z
CVE-2018-1643 
The Installation Verification Tool of IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144588
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-11-15T16:00:00.000Z
CVE-2018-1644 
IBM WebSphere Commerce Enterprise, Professional, Express, and Developer 9.0.0.0 - 9.0.0.4, 8.0.0.0 - 8.0.0.19, 8.0.1.0 - 8.0.1.13, 8.0.3.0 - 8.0.3.6, 8.0.4.0 - 8.0.4.14, and 7.0.0.0 Feature Pack 8 could allow an authenticated user to obtain sensitive information about another user.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Commerce
Published: 2018-08-27T15:00:00.000Z
CVE-2018-1647 
IBM QRadar Incident Forensics 7.2 and 7.3 does not properly restrict the size or amount of resources requested which could allow an unauthenticated user to cause a denial of service. IBM X-Force ID: 144650.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: QRadar Incident Forensics
Published: 2018-10-05T13:00:00.000Z
CVE-2018-1648 
IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144653.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-05T17:00:00.000Z
CVE-2018-1649 
IBM QRadar Incident Forensics 7.2 and 7.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 144655.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar Incident Forensics
Published: 2018-10-05T13:00:00.000Z
CVE-2018-1650 
IBM QRadar SIEM 7.2 and 7.3 uses hard-coded credentials which could allow an attacker to bypass the authentication configured by the administrator. IBM X-Force ID: 144656.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: QRadar SIEM
Published: 2018-12-05T17:00:00.000Z
CVE-2018-1652 
IBM DataPower Gateway 7.1.0.0 through 7.1.0.19, 7.2.0.0 through 7.2.0.16, 7.5.0.0 through 7.5.0.10, 7.5.1.0 through 7.5.1.9, 7.5.2.0 through 7.5.2.9, and 7.6.0.0 through 7.6.0.2 and IBM MQ Appliance 8.0.0.0 through 8.0.0.8 and 9.0.1 through 9.0.5 could allow a local user to cause a denial of service through unknown vectors. IBM X-Force ID: 144724.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DataPower Gateways
vendor: IBM
product: MQ Appliance
Published: 2018-12-11T16:00:00.000Z
CVE-2018-1653 
IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144726.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Security Access Manager Appliance
Published: 2018-12-13T16:00:00.000Z
CVE-2018-1654 
IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 144747.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Curam Social Program Management
Published: 2018-12-11T16:00:00.000Z
CVE-2018-1655 
IBM AIX 5.3, 6.1, 7.1, and 7.2 contains a vulnerability in the rmsock command that may be used to expose kernel memory. IBM X-Force ID: 144748.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: AIX
Published: 2018-06-22T14:00:00.000Z
CVE-2018-1656 
The IBM Java Runtime Environment's Diagnostic Tooling Framework for Java (DTFJ) (IBM SDK, Java Technology Edition 6.0 , 7.0, and 8.0) does not protect against path traversal attacks when extracting compressed dump files. IBM X-Force ID: 144882.
Problem types: description: File Manipulation
Affected products: vendor: IBM
product: SDK, Java Technology Edition
Published: 2018-08-20T21:00:00.000Z
CVE-2018-1657 
IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 144883.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Publishing Engine
Published: 2019-01-04T15:00:00.000Z
CVE-2018-1658 
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to HTTP header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 144884.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-03-14T22:00:00.000Z
CVE-2018-1659 
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144885.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2018-09-25T16:00:00.000Z
CVE-2018-1660 
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 144886.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-09-27T19:00:00.000Z
CVE-2018-1661 
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144887.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: DataPower Gateways
Published: 2018-12-20T14:00:00.000Z
CVE-2018-1663 
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateways
Published: 2018-12-07T16:00:00.000Z
CVE-2018-1664 
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 echoing of AMP management interface authorization headers exposes login credentials in browser cache. IBM X-Force ID: 144890.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateway CD
vendor: IBM
product: DataPower Gateways
Published: 2018-09-25T16:00:00.000Z
CVE-2018-1665 
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 144891.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2018-12-13T16:00:00.000Z
CVE-2018-1666 
IBM DataPower Gateway 2018.4.1.0, 7.6.0.0 through 7.6.0.11, 7.5.2.0 through 7.5.2.18, 7.5.1.0 through 7.5.1.18, 7.5.0.0 through 7.5.0.19, and 7.7.0.0 through 7.7.1.3 could allow an authenticated user to inject arbitrary messages that would be displayed on the UI. IBM X-Force ID: 144892.
Problem types: description: Other
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2019-02-07T16:00:00.000Z
CVE-2018-1667 
IBM DataPower Gateway 7.6.0.0 through 7.6.0.10, 7.5.2.0 through 7.5.2.17, 7.5.1.0 through 7.5.1.17, 7.5.0.0 through 7.5.0.18, and 7.7.0.0 through 7.7.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 144893.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: DataPower Gateways
Published: 2018-12-13T16:00:00.000Z
CVE-2018-1668 
IBM DataPower Gateway 7.5.0.0 through 7.5.0.19, 7.5.1.0 through 7.5.1.18, 7.5.2.0 through 7.5.2.18, and 7.6.0.0 through 7.6.0.11 appliances allows "null" logins which could give read access to IPMI data to obtain sensitive information. IBM X-Force ID: 144894.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateway
Published: 2019-01-29T16:00:00.000Z
CVE-2018-1669 
IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.0.8 as well as IBM DataPower Gateway CD 7.7.0.0 - 7.7.1.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 144950.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: DataPower Gateways
vendor: IBM
product: DataPower Gateway CD
Published: 2018-09-25T16:00:00.000Z
CVE-2018-1670 
IBM Financial Transaction Manager for ACH Services for Multi-Platform 3.0.2 could allow an authenticated user to obtain sensitive product configuration information from log files. IBM X-Force ID: 144946.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Financial Transaction Manager
Published: 2018-10-04T15:00:00.000Z
CVE-2018-1671 
IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-12-10T14:00:00.000Z
CVE-2018-1672 
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Force ID: 144958.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-10-01T15:00:00.000Z
CVE-2018-1673 
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145108.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: WebSphere Portal
Published: 2018-10-12T05:00:00.000Z
CVE-2018-1674 
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Business Process Manager
Published: 2018-09-20T15:00:00.000Z
CVE-2018-1675 
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could expose password hashes in stored in system memory on target systems that are configured to use TADDM. IBM X-Force ID: 145110.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Tivoli Application Dependency Discovery Manager
Published: 2019-02-04T21:00:00.000Z
CVE-2018-1676 
IBM Planning Analytics 2.0.0 through 2.0.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145118.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Planning Analytics Local
Published: 2018-07-06T14:00:00.000Z
CVE-2018-1677 
IBM DataPower Gateways 7.1, 7.2, 7.5, 7.5.1, 7.5.2, 7.6, and 7.7 and IBM MQ Appliance are vulnerable to a denial of service, caused by the improper handling of full file system. A local attacker could exploit this vulnerability to cause a denial of service. IBM X-Force ID: 145171.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DataPower Gateways
Published: 2018-12-20T14:00:00.000Z
CVE-2018-1679 
IBM Sterling B2B Integrator Standard Edition 5.2 through 5.2.6 could allow an unauthenticated user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 145180.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Sterling B2B Integrator
Published: 2018-07-20T16:00:00.000Z
CVE-2018-1680 
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 145236.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Security Privileged Identity Manager
Published: 2019-04-02T13:20:33.796Z
CVE-2018-1682 
IBM Watson Studio Local 1.2.3 could disclose sensitive information over the network that an attacked could use in further attacks against the system. IBM X-Force ID: 145238.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Watson Studio Local
Published: 2019-12-30T15:35:20.872Z
CVE-2018-1683 
IBM WebSphere Application Server Liberty could allow a remote attacker to obtain sensitive information, caused by the failure to encrypt ORB communication. IBM X-Force ID: 145455.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-09-26T15:00:00.000Z
CVE-2018-1684 
IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT topic string publishing that can cause a denial of service attack. IBM X-Force ID: 145456.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2018-11-09T00:00:00.000Z
CVE-2018-1685 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2018-09-21T13:00:00.000Z
CVE-2018-1686 
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145505.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-10-05T13:00:00.000Z
CVE-2018-1688 
IBM Jazz Foundation (IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145509.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2019-03-14T22:00:00.000Z
CVE-2018-1690 
IBM Rhapsody Model Manager 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145510.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rhapsody Model Manager
Published: 2018-08-07T13:00:00.000Z
CVE-2018-1691 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145582.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1692 
IBM Rational Quality Manager (RQM) 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 145583.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2018-10-02T15:00:00.000Z
CVE-2018-1694 
IBM Jazz applications (IBM Rational Collaborative Lifecycle Management 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational DOORS Next Generation 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Quality Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Rhapsody Design Manager 5.0 through 5.02 and 6.0 through 6.0.6, IBM Rational Software Architect Design Manager 5.0 through 5.02 and 6.0 through 6.0.1, IBM Rational Team Concert 5.0 through 5.02 and 6.0 through 6.0.6) could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 145609.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Team Concert
vendor: IBM
product: Rational Software Architect Design Manager
vendor: IBM
product: Rational DOORS Next Generation
vendor: IBM
product: Rational Collaborative Lifecycle Management
vendor: IBM
product: Rational Rhapsody Design Manager
vendor: IBM
product: Rational Quality Manager
vendor: IBM
product: Rational Engineering Lifecycle Manager
Published: 2018-11-06T16:00:00.000Z
CVE-2018-1695 
IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 145769.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: WebSphere Application Server
Published: 2018-09-06T14:00:00.000Z
CVE-2018-1697 
IBM Maximo Asset Management 7.6 could allow an authenticated user to enumerate usernames using a specially crafted HTTP request. IBM X-Force ID: 145966.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-12-05T17:00:00.000Z
CVE-2018-1698 
IBM Maximo Asset Management 7.6 through 7.6.3 could allow an unauthenticated attacker to obtain sensitive information from error messages. IBM X-Force ID: 145967.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-09-13T15:00:00.000Z
CVE-2018-1699 
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145968.
Problem types: description: Data Manipulation
Affected products: vendor: IBM
product: Maximo Asset Management
Published: 2018-08-24T11:00:00.000Z
CVE-2018-1701 
IBM InfoSphere Information Server 11.7 could allow an authenciated user under specialized conditions to inject commands into the installation process that would execute on the WebSphere Application Server. IBM X-Force ID: 145970.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: InfoSphere Information Server
Published: 2019-02-15T20:00:00.000Z
CVE-2018-1702 
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 146189.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Spectrum Symphony
vendor: IBM
product: Platform Symphony
Published: 2018-09-28T13:00:00.000Z
CVE-2018-1704 
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 146339.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Platform Symphony
vendor: IBM
product: Spectrum Symphony
Published: 2018-09-28T13:00:00.000Z
CVE-2018-1705 
IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Platform Symphony
vendor: IBM
product: Spectrum Symphony
Published: 2018-08-28T11:00:00.000Z
CVE-2018-1706 
IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 146341.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Spectrum Symphony
Published: 2018-10-11T12:00:00.000Z