Cerebrate 安全漏洞

Cerebrate is an open source platform. Designed to act as an interconnection coordinator between trusted contact information providers and other security tools. A security vulnerability exists in Cerebrate version 1.12 that stems from not properly considering the organizationid when creating API...

PT-2023-19545 · Wpdevart · Wpdevart Organization Chart

Name of the Vulnerable Software and Affected Versions: WpDevArt Organization chart versions 1.4.4 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a...

CVE-2018-1709

Jazz for Service Management (IBM) versions 1.1.0–1.1.3 are affected by CVE-2018-1709. The IBM bulletin describes a cross-site scripting vulnerability in the Dashboard Application Services Hub that can allow arbitrary JavaScript in the web UI and potential credentials disclosure within a trusted s...

CVE-2018-1995

CVE-2018-1995 is documented in the IBM UrbanCode Deploy bulletin as a vulnerability where authenticated web agents could modify another agent’s properties via a crafted request. Affected products are IBM UrbanCode Deploy Web Agents (versions 6.2.7.3–6.2.7.4 and 7.0–7.0.1.1); JMS-based agents are ...

dnsdpg.org Cross Site Scripting vulnerability OBB-3201360

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2018-1613

CVE-2018-1613 is a confirmed vulnerability in IBM Platform Symphony and IBM Spectrum Symphony involving a vertical authorization bypass in the Symping utility. A local attacker could obtain a privileged token and gain privileges or access highly sensitive data. Affected products/versions: IBM Pla...

CVE-2018-1707

CVE-2018-1707 is a stored cross-site scripting (XSS) vulnerability affecting IBM Platform Symphony and IBM Spectrum Symphony. Affected products/versions: Platform Symphony 7.1 Fix Pack 1 and 7.1.1; Spectrum Symphony 7.1.2 and 7.2.0.2. The vulnerability allows an attacker to embed arbitrary JavaSc...

CVE-2018-1681

CVE-2018-1681 affects IBM Data Science Experience Local. The IBM security bulletin confirms a vulnerability that could disclose highly sensitive information to a local unprivileged user. Affected versions are IBM Data Science Experience Local 1.1.0, 1.1.1, 1.1.2, 1.1.3, and 1.2.0. The remediation...

CVE-2018-1919

IBM Security Bulletin for CVE-2018-1919 details a local privilege-escalation in the SUID handling of the egosh binary in IBM Platform Symphony and IBM Spectrum Symphony. When starting a host with egosh ego start, the egosh binary is run with root SUID, creating a potential path for a non-root use...

CVE-2018-1769

CVE-2018-1769 affects IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center). The vulnerability occurs when tracing is enabled for OC_TASKS, causing the monitoring ID password to be written in plaintext to trace files. Affected versions are 8.1.0.000–8.1.6.100 ...

CVE-2018-1855

CVE-2018-1855 is an IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) cross-site scripting vulnerability. Versions affected: 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1.9.100. The flaw allows a remote attacker to inject arbitrary JavaScript into the Web UI, pote...

CVE-2018-1854

IBM Spectrum Protect Operations Center (formerly Tivoli Storage Manager Operations Center) is affected by CVE-2018-1854: a cross-site scripting vulnerability in the Web UI that can lead to credentials disclosure within a trusted session. Affected versions are 8.1.0.000–8.1.6.100 and 7.1.0.000–7.1...

CVE-2018-1589

CVE-2018-1589 is documented in IBM’s Multi-Cloud Data Encryption (MDE) security bulletin as a denial-of-service vulnerability. The issue occurs because MDE does not properly restrict the size or amount of resources requested or influenced by an actor, allowing resource consumption beyond intended...

CVE-2017-1579

CVE-2017-1579 is addressed in IBM DOORS Next Generation (DNG/RRC). The IBM Security Bulletin reports a cross-site scripting vulnerability in the Web UI of Rational DOORS Next Generation, allowing an attacker to embed arbitrary JavaScript and potentially disclose credentials within a trusted sessi...

CVE-2012-1359

CVE-2012-1359, as reserved, has a connected IBM advisory detailing multiple security vulnerabilities in IBM JRE 7.0 SR2 or earlier (and non-IBM Java 7.0 when used with Rational Functional Tester). The bulletin lists numerous CVEs (e.g., CVE-2012-3159 and related issues across JRE components such ...

CVE-2018-1385

CVE-2018-1385 is referenced in IBM API Connect security bulletin: it describes use of weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Affected IBM API Connect versions are 5.0.0.0–5.0.6.5, 5.0.7.0–5.0.7.2, and 5.0.8.0–5.0.8.1. Re...

CVE-2016-6041

IBM Tealeaf Customer Experience (IBM Tealeaf CX) is affected by CVE-2016-6041: the product does not properly secure session cookies, potentially allowing an authenticated user to obtain sensitive information. Affected versions include IBM Tealeaf CX v8.7 through v9.0.2. Remediation paths are prov...

CVE-2017-1634

IBM Financial Transaction Manager (FTM) for ACH Services and FTM for Corporate Payment Services are affected by CVE-2017-1634, a cross-site scripting (XSS) vulnerability that allows an attacker to inject arbitrary JavaScript into the Web UI, potentially exposing credentials within a trusted sessi...

CVE-2018-1365

Summary: CVE-2018-1365 affects IBM Cloud Event Management and IBM Alert Notification when viewed in Internet Explorer. The vulnerability allows an attacker to hijack a victim’s click actions by loading the affected console in an iframe not belonging to the system, potentially enabling further att...

CVE-2017-1797

IBM Kenexa LCMS Premier on Cloud is affected by a SQL injection vulnerability tracked as CVE-2017-1797. A remote attacker could send specially crafted SQL statements to view, add, modify, or delete data in the back-end database. Affected versions include 9.3 through 11.1; remediation is to upgrad...