rainbutterfly/cve_corpus huggingface dataset:
CVE-2017-18894 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. Sometimes. resource-owner authorization is bypassed, allowing account takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:56.000Z
CVE-2017-18895 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to obtain sensitive information (user statuses) via a REST API version 4 endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:43:14.000Z
CVE-2017-18896 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows attackers to add DEBUG lines to the logs via a REST API version 3 logging endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:54.000Z
CVE-2017-18897 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5, when used as an OAuth 2.0 service provider. It mishandles a deny action for a redirection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:10:53.000Z
CVE-2017-18898 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It allows crafted posts that potentially cause a web browser to hang.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:43:19.000Z
CVE-2017-18899 
An issue was discovered in Mattermost Server before 4.2.0, 4.1.1, and 4.0.5. It mishandles IP-based rate limiting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:42:06.000Z
CVE-2017-18900 
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows CSV injection via a compliance report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:43:18.000Z
CVE-2017-18901 
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover a team invite ID by requesting a JSON document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:09:26.000Z
CVE-2017-18902 
An issue was discovered in Mattermost Server before 4.1.0, 4.0.4, and 3.10.3. It allows attackers to discover team invite IDs via team API endpoints.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:43:20.000Z
CVE-2017-18903 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. CSRF can occur if CORS is enabled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:44:09.000Z
CVE-2017-18904 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. It allows XSS via an uploaded file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:45:31.000Z
CVE-2017-18905 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when used as an OAuth 2.0 service provider, Session invalidation was mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:17:03.000Z
CVE-2017-18906 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2, when Single Sign-On OAuth2 is used. An attacker could claim somebody else's account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:18:16.000Z
CVE-2017-18907 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. XSS could occur via a channel header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:19:38.000Z
CVE-2017-18908 
An issue was discovered in Mattermost Server before 4.0.0, 3.10.2, and 3.9.2. A password-reset request was sometime sent to an attacker-provided e-mail address.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:16:08.000Z
CVE-2017-18909 
An issue was discovered in Mattermost Server before 3.9.0 when SAML is used. Encryption and signature verification are not mandatory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:45:57.000Z
CVE-2017-18910 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. E-mail notifications can have spoofed links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:45:56.000Z
CVE-2017-18911 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. The X.509 certificate validation can be skipped for a TLS-based e-mail server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:45:55.000Z
CVE-2017-18912 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. It allows an attacker to specify a full pathname of a log file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T18:45:54.000Z
CVE-2017-18913 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. XSS can occur via a link on an error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:16:09.000Z
CVE-2017-18914 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. An external link can occur on an error page even if it is not on an allowlist.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:16:05.000Z
CVE-2017-18915 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. After a restart of a server, an attacker might suddenly gain API Endpoint access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:16:03.000Z
CVE-2017-18916 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. API endpoint access control does not honor an integration permission restriction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:19:12.000Z
CVE-2017-18917 
An issue was discovered in Mattermost Server before 3.8.2, 3.7.5, and 3.6.7. Weak hashing was used for e-mail invitations, OAuth, and e-mail verification tokens.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:18:37.000Z
CVE-2017-18918 
An issue was discovered in Mattermost Server before 3.7.3 and 3.6.5. A System Administrator can place a SAML certificate at an arbitrary pathname.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:19:57.000Z
CVE-2017-18919 
An issue was discovered in Mattermost Server before 3.7.0 and 3.6.3. Attackers can use the API for unauthenticated team creation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:20:39.000Z
CVE-2017-18920 
An issue was discovered in Mattermost Server before 3.6.2. The WebSocket feature does not follow the Same Origin Policy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:20:58.000Z
CVE-2017-18921 
An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-19T19:21:28.000Z
CVE-2017-18922 
It was discovered that websockets.c in LibVNCServer prior to 0.9.12 did not properly decode certain WebSocket frames. A malicious attacker could exploit this by sending specially crafted WebSocket frames to a server, causing a heap-based buffer overflow.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-06-30T11:00:01.000Z
CVE-2017-18923 
beroNet VoIP Gateways before 3.0.16 have a PHP script that allows downloading arbitrary files, including ones with credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-07-29T19:47:39.000Z
CVE-2017-18924 
oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-04T04:38:47.000Z
CVE-2017-18925 
opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-26T17:58:19.000Z
CVE-2017-18926 
raptor_xml_writer_start_element_common in raptor_xml_writer.c in Raptor RDF Syntax Library 2.0.15 miscalculates the maximum nspace declarations for the XML writer, leading to heap-based buffer overflows (sometimes seen in raptor_qname_format_as_xml).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-11-06T17:48:08.000Z
CVE-2017-1081 
In FreeBSD before 11.0-STABLE, 11.0-RELEASE-p10, 10.3-STABLE, and 10.3-RELEASE-p19, ipfilter using "keep state" or "keep frags" options can cause a kernel panic when fed specially crafted packet fragments due to incorrect memory handling.
Problem types: cwe_id: CWE-416
description: Kernel panic due to use after free (CWE-416)
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-04-10T13:00:00.000Z
CVE-2017-1082 
In FreeBSD 11.x before 11.1-RELEASE and 10.x before 10.4-RELEASE, the qsort algorithm has a deterministic recursion pattern. Feeding a pathological input to the algorithm can lead to excessive stack usage and potential overflow. Applications that use qsort to handle large data set may crash if the input follows the pathological pattern.
Problem types: description: Userspace stack overflow
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-09-12T14:00:00.000Z
CVE-2017-1083 
In FreeBSD before 11.2-RELEASE, a stack guard-page is available but is disabled by default. This results in the possibility a poorly written process could be cause a stack overflow.
Problem types: description: Userspace stack overflow
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-09-12T14:00:00.000Z
CVE-2017-1084 
In FreeBSD before 11.2-RELEASE, multiple issues with the implementation of the stack guard-page reduce the protections afforded by the guard-page. This results in the possibility a poorly written process could be cause a stack overflow.
Problem types: description: Userspace stack overflow
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-09-12T14:00:00.000Z
CVE-2017-1085 
In FreeBSD before 11.2-RELEASE, an application which calls setrlimit() to increase RLIMIT_STACK may turn a read-only memory region below the stack into a read-write region. A specially crafted executable could be exploited to execute arbitrary code in the user context.
Problem types: description: Userspace stack overflow
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2018-09-12T14:00:00.000Z
CVE-2017-1086 
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger. As a result, some bytes from the kernel stack of the thread using ptrace (PT_LWPINFO) call can be observed in userspace.
Problem types: description: Kernel Information Leak
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2017-11-16T20:00:00.000Z
CVE-2017-1087 
In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. As a result, a malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid. This issue could lead to a Denial of Service or local privilege escalation.
Problem types: description: Privilege escalation
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2017-11-16T20:00:00.000Z
CVE-2017-1088 
In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible. As a result, some bytes from the kernel stack can be observed in userspace.
Problem types: description: Kernel information leak
Affected products: vendor: FreeBSD
product: FreeBSD
Published: 2017-11-16T20:00:00.000Z
CVE-2017-1092 
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
Problem types: description: Gain Access
Affected products: vendor: IBM Corporation
product: Informix Servers
Published: 2017-05-22T20:00:00.000Z
CVE-2017-1093 
IBM AIX 6.1, 7.1, and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges.
Problem types: description: Gain Privileges
Affected products: vendor: IBM Corporation
product: AIX
Published: 2017-02-02T22:00:00.000Z
CVE-2017-1096 
IBM Jazz Reporting Service (JRS) 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120656.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Jazz Reporting Service
Published: 2017-07-05T18:00:00.000Z
CVE-2017-1097 
IBM Emptoris Strategic Supply Management Platform 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 120657.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Emptoris Strategic Supply Management
Published: 2017-09-05T21:00:00.000Z
CVE-2017-1098 
IBM Emptoris Supplier Lifecycle Management 10.1.0.x is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120658.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2017-09-07T16:00:00.000Z
CVE-2017-1099 
IBM Jazz Foundation could expose potentially sensitive information to authenticated users through stack trace error conditions. IBM X-Force ID: 120659.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Rational Collaborative Lifecycle Management
Published: 2017-06-13T19:00:00.000Z
CVE-2017-1100 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120661.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2017-06-13T19:00:00.000Z
CVE-2017-1101 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120662.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2017-06-13T19:00:00.000Z
CVE-2017-1102 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120663.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2017-06-13T19:00:00.000Z
CVE-2017-1103 
IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources. IBM X-Force ID: 120665.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Rational Collaborative Lifecycle Management
Published: 2017-05-10T14:00:00.000Z
CVE-2017-1104 
IBM Quality Manager (RQM) 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120666.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Quality Manager
Published: 2017-06-13T19:00:00.000Z
CVE-2017-1105 
IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service. IBM X-Force ID: 120668.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: DB2 for Linux, UNIX and Windows
Published: 2017-06-27T16:00:00.000Z
CVE-2017-1106 
IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 120744.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Cram Social Program Management
Published: 2017-06-28T18:00:00.000Z
CVE-2017-1107 
IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Marketing Platform
Published: 2019-06-19T13:30:19.654Z
CVE-2017-1110 
IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher privileged user. IBM X-Force ID: 120915.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Cram Social Program Management
Published: 2017-08-28T20:00:00.000Z
CVE-2017-1113 
IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121151.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Rational Team Concert
Published: 2017-07-05T17:00:00.000Z
CVE-2017-1114 
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121152.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM
product: Campaign
Published: 2018-09-07T16:00:00.000Z
CVE-2017-1115 
IBM Campaign 9.1, 9.1.2, and 10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 121153.
Problem types: description: Gain Access
Affected products: vendor: IBM
product: Campaign
Published: 2018-09-07T16:00:00.000Z
CVE-2017-1116 
IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0 contains excessive details on the client side which could provide information useful for an authenticated user to conduct other attacks. IBM X-Force ID: 121154.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Campaign
Published: 2018-04-27T15:00:00.000Z
CVE-2017-1117 
IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to cause a denial of service to the MQXR channel when trace is enabled. IBM X-Force ID: 121155.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: MQ
Published: 2017-06-21T18:00:00.000Z
CVE-2017-1118 
IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker to cause the MQIPT to stop responding due to an incorrectly configured security policy. IBM X-Force ID: 121156.
Problem types: description: Denial of Service
Affected products: vendor: IBM
product: WebSphere MQ
Published: 2017-08-02T17:00:00.000Z
CVE-2017-1119 
IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote attacker to obtain sensitive information. An attacker could send a specially-crafted request to cause an error message to be returned containing the full root path. An attacker could use this information to launch further attacks against the affected system. IBM X-Force ID: 121171.
Problem types: description: Obtain Information
Affected products: vendor: IBM
product: Marketing Operations
Published: 2018-11-09T00:00:00.000Z
CVE-2017-1120 
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000152.
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: WebSphere Portal
Published: 2017-03-27T22:00:00.000Z
CVE-2017-1121 
IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1997743
Problem types: description: Cross-Site Scripting
Affected products: vendor: IBM Corporation
product: WebSphere Application Server
Published: 2017-02-13T22:00:00.000Z
CVE-2017-1122 
IBM Security Guardium 8.2, 9.0, and 10.0 contains a vulnerability that could allow a local attacker with CLI access to inject arbitrary commands which would be executed as root. IBM X-Force ID: 121174.
Problem types: description: Gain Privileges
Affected products: vendor: IBM
product: Security Guardium
Published: 2017-04-20T21:00:00.000Z
CVE-2017-1124 
IBM Maximo Asset Management 7.1, 7.5, and 7.6 could allow a local attacker to obtain sensitive information using HTTP Header Injection. IBM Reference #: 1998053.
Problem types: description: Obtain Information
Affected products: vendor: IBM Corporation
product: Maximo Asset Management
Published: 2017-03-07T17:00:00.000Z