CVE-2018-1671: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951...

PT-2018-13697

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management version 7.0.3 Description The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

Security Bulletin: IBM Cúram Universal Access is vulnerable to CRLF Injection attack when not deployed on IBM WebSphere. (CVE-2014-4803)

Summary The Universal Access component of IBM Cúram Social Program Management, when not deployed on IBM WebSphere Application Server, is vulnerable to CRLF Injection attack; this is caused by improper sanitization/escaping of a parameter on one page. Vulnerability Details CVEID: CVE-2014-4803 A...

Information disclosure

IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id. IBM X-Force ID: 107106...

PT-2018-4408

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.1.x through 6.1.1.0 Description The issue allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id...

CVE-2015-7401: Exposure of Sensitive Information to an Unauthorized Actor

IBM Curam Social Program Management 6.1.x before 6.1.1.1 allows remote authenticated users to bypass intended access restrictions and obtain sensitive document information by guessing the document id. IBM X-Force ID: 107106...

CVE-2016-0261: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0.0 before SP2 EP29, 6.0.4 before 6.0.4.6 iFix3, 6.0.5 before 6.0.5.9 iFix2, 6.1.0 before 6.1.0.1 iFix1, and 6.1.1 before 6.1.1.1 iFix1; and IBM Care Management 6.0 allows remote attackers to inject arbitrary web scri...

PT-2018-4594

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0.0 through 6.0.0 before SP2 EP29 IBM Curam Social Program Management versions 6.0.4 through 6.0.4 before 6.0.4.6 iFix3 IBM Curam Social Program Management versions 6.0.5 through 6.0.5 before...

CVE-2018-1362: Undefined Security Weakness

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 within Citizen Portal could allow an authenticated user to withdraw other user's submitted applications from the system and possibly obtain privileges. IBM X-Force ID: 137380...

PT-2018-12005

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, and 7.0.1 Description The issue allows an authenticated user to withdraw other users' submitted applications from the system and possibly obtain privileges. Recommendations For...

CVE-2017-1739

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2017-1740

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2017-1739

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

CVE-2017-1740: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2018-6510

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, 7.0.1, 7.0.2 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

CVE-2017-1739: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, and 7.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessio...

PT-2018-6509

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, and 7.0.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

IBM Cúram Social Program Management Cross-Site Scripting Vulnerability (CNVD-2017-33074)

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A cross-site scripting vulnerability exists in IBM Curam SPM. A remote attacker could exploit this vulnerability to inje...

PT-2017-5966

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management versions 6.0 SP2 through 6.0.5 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations: For versions 6.0 SP2...

CVE-2014-6191: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568...