CVE-2018-1714

The IBM bulletin confirms CVE-2018-1714 affects IBM Cloud Private 2.1.0 where any user authorized to deploy a Helm chart can install an unsafe chart that runs with privileges greater than the Helm user’s. Impact is privilege escalation within the cluster, with CVSS Base Score 7. Remediation: upgr...

CVE-2018-1769

CVE-2018-1769 affects IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center). The vulnerability occurs when tracing is enabled for OC_TASKS, causing the monitoring ID password to be written in plaintext to trace files. Affected versions are 8.1.0.000–8.1.6.100 ...

CVE-2018-1855

CVE-2018-1855 is an IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) cross-site scripting vulnerability. Versions affected: 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1.9.100. The flaw allows a remote attacker to inject arbitrary JavaScript into the Web UI, pote...

CVE-2018-1854

IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) is affected by CVE-2018-1854: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1...

CVE-2021-32861

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-32856. Reason: This candidate is a reservation duplicate of CVE-2021-32856. Notes: All CVE users should reference CVE-2021-32856 instead of this candidate. All references and descriptions in this candidate have been removed t...

CVE-2018-1590

IBM Multi-Cloud Data Encryption (MDE) is affected by CVE-2018-1590: it does not invalidate session tokens in a timely manner, potentially allowing attackers with local access to log into a closed browser session. Affected versions: MDE 2.1–2.1.0.1. Remediation: upgrade to MDE 2.1.0.2 (Multi-Cloud...

CVE-2018-1589

CVE-2018-1589 is documented in IBM’s Multi-Cloud Data Encryption (MDE) security bulletin as a denial-of-service vulnerability. The issue occurs because MDE does not properly restrict the size or amount of resources requested or influenced by an actor, allowing resource consumption beyond intended...

CVE-2018-1592

CVE-2018-1592 (IBM Multi-Cloud Data Encryption, MDE) is an information-exposure vulnerability caused by storing sensitive data in URL parameters. The IBM reports show affected MDE versions: 2.1-2.1.0.1 and 2.1-2.1.0.2, with remediation available via upgrade to 2.1.0.2 (for 2.1 line) or to 2.2.0.0...

CVE-2017-1579

CVE-2017-1579 is addressed in IBM DOORS Next Generation (DNG/RRC). The IBM Security Bulletin reports a cross-site scripting vulnerability in the Web UI of Rational DOORS Next Generation, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted sessi...

CVE-2012-1359

CVE-2012-1359, as reserved, has a connected IBM advisory detailing multiple security vulnerabilities in IBM JRE 7.0 SR2 or earlier (and non-IBM Java 7.0 when used with Rational Functional Tester). The bulletin lists numerous CVEs (e.g., CVE-2012-3159 and related issues across JRE components such ...

CVE-2016-6109

CVE-2016-6109 is a cross-site scripting vulnerability in IBM Business Process Manager (BPM) used with IBM Cloud Orchestrator/Enterprise. IBM advisories (IBM BPM/Cloud Orchestrator links) enumerate affected BPM/Cloud Orchestrator versions and state the vulnerability allows embedding arbitrary Java...

CVE-2016-9974

IBM Security Guardium Database Activity Monitor is affected by CVE-2016-9974: a shell injection in the CLI 'support execute' command could allow a locally authenticated attacker to execute arbitrary commands. Affected versions include Guardium v9.x and v10.x (up to 10.1.2). The root cause is comm...

CVE-2017-16032

CVE-2017-16032 is a DoS vulnerability in the brace-expansion component used by IBM MobileFirst Platform Foundation 8.x.x. The IBM bulletin lists brace-expansion as vulnerable to regular expression denial of service (ReDoS) via crafted arguments, with affected versions tied to IBM MobileFirst Plat...

SUSE CVE-2006-2657

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2006-3017. Reason: This candidate is a reservation duplicate of CVE-2006-3017. Notes: All CVE users should reference CVE-2006-3017 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2008-2373

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-2863. Reason: This candidate is a reservation duplicate of CVE-2008-2863. Notes: All CVE users should reference CVE-2008-2863 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2008-2804

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2008-2800. Reason: This candidate is a reservation duplicate of CVE-2008-2800. Notes: All CVE users should reference CVE-2008-2800 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2010-2533

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-2621. Reason: This candidate is a reservation duplicate of CVE-2010-2621. Notes: All CVE users should reference CVE-2010-2621 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2012-3494

The setdebugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service host crash by writing to the reserved bits of the DR7 debug control register...

SUSE CVE-2012-5592

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6052. Reason: This candidate is a reservation duplicate of CVE-2012-6052. Notes: All CVE users should reference CVE-2012-6052 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...

SUSE CVE-2012-5596

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-6057. Reason: This candidate is a reservation duplicate of CVE-2012-6057. Notes: All CVE users should reference CVE-2012-6057 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental...