CVE-2018-1435

CVE-2018-1435 affects IBM Notes 8.5 and 9.0. The issue is a DLL hijacking vulnerability that could allow code execution when a user is tricked into opening a malicious executable in a directory under an attacker’s control. Connected sources reiterate IBM Notes DLL loading remote code execution vu...

CVE-2016-0369

IBM Forms Experience Builder versions 8.5, 8.5.1 and 8.6 are affected by an XML External Entity (XXE) processing vulnerability. The root cause is XXE when processing XML data, which could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3 base score is 2.7 (LOW). R...

CVE-2017-1720

IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807...

Code injection

IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633...

CVE-2017-1711

CVE-2017-1711 affects IBM iNotes 8.5 and 9.0 SUService. The vulnerability arises from the risk of loading a malicious DLL masquerading as a Windows DLL located in the temp directory, potentially allowing code execution. Connected documents reiterate the same issue and reference IBM X-Force ID 134...

CVE-2017-1720

CVE-2017-1720 affects IBM Notes 8.5 and 9.0, where a local attacker could execute arbitrary commands by crafting a command line sent via Shared Memory IPC. Connected CNVD-2018-03879 describes an elevation of privilege vulnerability in IBM Client Application Access and Notes related to IPC. The NV...

CVE-2017-15706

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a...

CVE-2017-1423

IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476...

CVE-2017-1494

IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692...

CVE-2017-1423

IBM WebSphere Portal versions 8.5 and 9.0 expose backend server URLs that are configured for the Web Application Bridge component. This vulnerability (CVE-2017-1423) is an information-disclosure flaw triggered by the Web Application Bridge, leading to potential exposure of backend endpoints. It i...

CVE-2017-1494

CVE-2017-1494 pertains to a cross-site scripting (XSS) vulnerability in IBM BPM/Process Designer web UI. Connected IBM bulletin entries confirm the flaw allows injection of JavaScript into the Web UI, potentially exposing credentials within a trusted session. Affected products/versions include IB...

Authentication flaw

EMC RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C allow attackers to bypass authentication, aka an "Error Handling Vulnerability."...

CVE-2017-1531

IBM Business Process Manager versions 7.5, 8.0, and 8.5 are described as vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript injection and potentially leading to credential disclosure within a trusted session. The connected documents confirm the affected product and t...

Micro Focus VisiBroker integer overflow vulnerability (CNVD-2017-34016)

Micro Focus VisiBroker is a CORBA environment for developing, deploying and managing distributed applications from Micro Focus, UK. An integer overflow vulnerability exists in Micro Focus VisiBroker version 8.5. No information about this vulnerability is available at this time...

Micro Focus VisiBroker Integer Overflow Vulnerability

Micro Focus VisiBroker is a CORBA environment for developing, deploying and managing distributed applications from Micro Focus, UK. An integer overflow vulnerability exists in Micro Focus VisiBroker version 8.5. An attacker could exploit this vulnerability to cause a denial of service...

Integer overflow

An integer overflow CWE-190 led to an out-of-bounds write CWE-787 on a heap-allocated area, leading to heap corruption in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed...

CVE-2017-9281

An integer overflow CWE-190 potentially causing an out-of-bounds read CWE-125 vulnerability in Micro Focus VisiBroker 8.5 can lead to a denial of service...

CVE-2017-9282

An integer overflow CWE-190 led to an out-of-bounds write CWE-787 on a heap-allocated area, leading to heap corruption in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed...

Design/Logic Flaw

An out-of-bounds read CWE-125 vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed...

Integer overflow

An integer overflow CWE-190 potentially causing an out-of-bounds read CWE-125 vulnerability in Micro Focus VisiBroker 8.5 can lead to a denial of service...