CVE-2017-1447

CVE-2017-1447 affects IBM Emptoris Sourcing 9.5.x through 10.1.x. The vulnerability is a cross-site scripting flaw in the Web UI that allows an attacker to embed arbitrary JavaScript, potentially altering functionality and enabling credential disclosure within a trusted session. Affected componen...

CVE-2017-1447

IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128172...

CVE-2017-1450

IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a maliciou...

CVE-2017-1449

IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a maliciou...

CVE-2017-1449

IBM Emptoris Sourcing (9.5.x–10.1.x; also related to Emptoris Contract Management) is affected by CVE-2017-1449 due to an open redirect vulnerability that could be exploited by a remote attacker to spoof the URL and lead a user to a malicious site, enabling phishing and potential sensitive-data e...

PT-2017-13490

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 9.5 through 10.1.3 Description The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, the attacker could exploi...

PT-2017-13476

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 9.5 through 10.1.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2017-1444: Improper Neutralization of Input During Web Page Generation

IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128110...

CVE-2017-1450: URL Redirection to Untrusted Site

IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a maliciou...

PT-2017-13479

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 9.5 through 10.1.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2017-1447: Improper Neutralization of Input During Web Page Generation

IBM Emptoris Sourcing 9.5 - 10.1.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128172...

CVE-2017-1449: URL Redirection to Untrusted Site

IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a maliciou...

PT-2017-13487

Name of the Vulnerable Software and Affected Versions IBM Emptoris Sourcing versions 9.5 through 10.1.3 Description The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, the attacker could exploi...

CVE-2017-1445

IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

Cross site request forgery (csrf)

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107...

Cross site scripting

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 12810...

Cross site scripting

IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force I...

CVE-2017-1440

IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM...

CVE-2017-1442

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107...

CVE-2017-1443

IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 12810...