3508 matches found
CVE-2018-1603
IBM Rational Quality Manager is affected by CVE-2018-1603: cross-site scripting in RQM 5.0–5.02 and 6.0–6.0.6, enabling arbitrary JavaScript in the Web UI and potentially credential disclosure in a trusted session. The CVSS v3 base score is 5.4 (Medium), with network access, low attack complexity...
CVE-2018-1439
IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
Cross site scripting
IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
CVE-2018-1605
Summary : CVE-2018-1605 affects IBM Rational Quality Manager (RQM) 5.0–5.02 and 6.0–6.0.6, introducing a cross-site scripting (XSS) vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. The root cause is input handling in the Web UI that allows embedding of...
CVE-2018-1440
CVE-2018-1440 affects IBM Rational Quality Manager (RQM) 5.0–5.02 and 6.0–6.0.6, where a cross-site scripting flaw in the Web UI could let an attacker embed arbitrary JavaScript, potentially disclosing credentials within a trusted session. Remediation per IBM includes upgrading to 5.0.2 iFix27 or...
CVE-2018-1601
IBM Rational Quality Manager RQM 5.0 through 5.02 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...
CVE-2018-1403
CVE-2018-1403 affects IBM Rational Quality Manager (RQM) versions 5.0–5.0.2 and 6.0–6.0.6. The issue is a cross-site scripting flaw in the Web UI that lets an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure in a trusted session. Root cause: improper sanitization...
CVE-2018-16586
In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...
CVE-2018-16586
In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...
CVE-2018-16586
In Open Ticket Request System OTRS 4.0.x before 4.0.32, 5.0.x before 5.0.30, and 6.0.x before 6.0.11, an attacker could send a malicious email to an OTRS system. If a logged in user opens it, the email could cause the browser to load external image or CSS resources...
CVE-2018-1610
IBM Rational DOORS Next Generation 5.0 through 5.0.2 and 6.0 through 6.0.6 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trust...
CVE-2018-1610
IBM Rational DOORS Next Generation (RDNG) versions affected: 5.0–5.0.2 and 6.0–6.0.6. The vulnerability is a cross-site scripting flaw in the Web UI that can allow an attacker to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Root cause details...
CVE-2018-1588
The CVE-2018-1588 entry concerns IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0–5.0.2 and 6.0–6.0.6) with a XML External Entity (XXE) vulnerability when processing XML data. Underlying issue: XXE allow remote attackers to exfiltrate sensitive information or consume memory res...
websockets is vulnerable to denial of service by memory exhaustion
The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...
GHSA-6G87-FF9Q-V847 websockets is vulnerable to denial of service by memory exhaustion
The Python websockets library version 4 contains a CWE-409: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Servers and clients, unless configured with compression=None that can result in Denial of Service by memory exhaustion. This attack appears to be exploitable...
CVE-2018-1791
IBM Connections 5.0, 5.5, and 6.0 is vulnerable to an External Service Interaction attack, caused by improper validation of a request property. By submitting suitable payloads, an attacker could exploit this vulnerability to induce the Connections server to attack other systems. IBM X-Force ID:...
CVE-2018-1791
CVE-2018-1791 affects IBM Connections versions 5.0, 5.5, and 6.0. The vulnerability stems from improper validation of a request property, enabling an External Service Interaction where an attacker could cause the Connections server to attack other systems. Public sources (NVD/IBM X-Force) assign ...
Privilege escalation
Escalation of privilege in Reference UI in Intel Data Center Manager SDK 5.0 and before may allow an unauthorized remote unauthenticated user to potentially execute code via administrator privileges...
CuteFTP 5.0 - Buffer Overflow Exploit
Exploit for windows platform in category local exploits Exploit Title: CuteFTP 5.0 - Buffer Overflow Author: Matteo Malvica Vendor homepage: www.globalscape.com Software: CuteFTP 5.0.4 XP - build 54.8.6.1 Software Link: http://installer.globalscape.com/pub/cuteftp/archive/english/cuteftp50.exe...
