CVE-2018-1445

IBM WebSphere Portal (versions 8.0.0–8.0.0.1, 8.5, 9.0) is affected by CVE-2018-1445 for a cross-site scripting (XSS) vulnerability caused by improper validation of user-supplied input. An unauthenticated, remote attacker can lure a user to a specially crafted URL to execute arbitrary script in t...

Drupal 8.5.x < 8.5.1 RCE

Binary data 700230.prm...

CVE-2018-1437

IBM Notes 8.5 and 9.0 are affected by CVE-2018-1437 due to an error related to untrusted search paths that enables DLL hijacking. This local vulnerability could allow an attacker to execute arbitrary code on the system or cause the application to crash. The issue is tied to the System Diagnostics...

CVE-2018-1444

CVE-2018-1444 affects IBM WebSphere Portal 8.5 and 9.0, where a cross-site scripting vulnerability arises from improper validation of user-supplied input. An unauthenticated remote attacker can entice a user to click a crafted URL to execute arbitrary script in the user’s browser, with potential ...

CVE-2018-1435

CVE-2018-1435 affects IBM Notes 8.5 and 9.0. The issue is a DLL hijacking vulnerability that could allow code execution when a user is tricked into opening a malicious executable in a directory under an attacker’s control. Connected sources reiterate IBM Notes DLL loading remote code execution vu...

CVE-2018-1437

IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM...

CVE-2016-0369

IBM Forms Experience Builder versions 8.5, 8.5.1 and 8.6 are affected by an XML External Entity (XXE) processing vulnerability. The root cause is XXE when processing XML data, which could allow a remote authenticated attacker to obtain sensitive information. The CVSS v3 base score is 2.7 (LOW). R...

Code injection

IBM Notes and Domino NSD 8.5 and 9.0 could allow an authenticated local user without administrative privileges to gain System privilege. IBM X-Force ID: 134633...

CVE-2017-1720

IBM Notes 8.5 and 9.0 could allow a local attacker to execute arbitrary commands by carefully crafting a command line sent via the shared memory IPC. IBM X-Force ID: 134807...

CVE-2017-1711

CVE-2017-1711 affects IBM iNotes 8.5 and 9.0 SUService. The vulnerability arises from the risk of loading a malicious DLL masquerading as a Windows DLL located in the temp directory, potentially allowing code execution. Connected documents reiterate the same issue and reference IBM X-Force ID 134...

CVE-2017-1720

CVE-2017-1720 affects IBM Notes 8.5 and 9.0, where a local attacker could execute arbitrary commands by crafting a command line sent via Shared Memory IPC. Connected CNVD-2018-03879 describes an elevation of privilege vulnerability in IBM Client Application Access and Notes related to IPC. The NV...

CVE-2017-15706

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a...

CVE-2017-1494

IBM Business Process Manager 8.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128692...

CVE-2017-1423

IBM WebSphere Portal 8.5 and 9.0 exposes backend server URLs that are configured for usage by the Web Application Bridge component. IBM X-Force ID: 127476...

CVE-2017-1423

IBM WebSphere Portal versions 8.5 and 9.0 expose backend server URLs that are configured for the Web Application Bridge component. This vulnerability (CVE-2017-1423) is an information-disclosure flaw triggered by the Web Application Bridge, leading to potential exposure of backend endpoints. It i...

CVE-2017-1494

CVE-2017-1494 pertains to a cross-site scripting (XSS) vulnerability in IBM BPM/Process Designer web UI. Connected IBM bulletin entries confirm the flaw allows injection of JavaScript into the Web UI, potentially exposing credentials within a trusted session. Affected products/versions include IB...

Authentication flaw

EMC RSA Authentication Agent API 8.5 for C and RSA Authentication Agent SDK 8.6 for C allow attackers to bypass authentication, aka an "Error Handling Vulnerability."...

CVE-2017-1531

IBM Business Process Manager versions 7.5, 8.0, and 8.5 are described as vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript injection and potentially leading to credential disclosure within a trusted session. The connected documents confirm the affected product and t...

Micro Focus VisiBroker Integer Overflow Vulnerability

Micro Focus VisiBroker is a CORBA environment for developing, deploying and managing distributed applications from Micro Focus, UK. An integer overflow vulnerability exists in Micro Focus VisiBroker version 8.5. An attacker could exploit this vulnerability to cause a denial of service...

Micro Focus VisiBroker integer overflow vulnerability (CNVD-2017-34016)

Micro Focus VisiBroker is a CORBA environment for developing, deploying and managing distributed applications from Micro Focus, UK. An integer overflow vulnerability exists in Micro Focus VisiBroker version 8.5. No information about this vulnerability is available at this time...