CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

Information disclosure

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-1481

CVE-2018-1481 affects IBM BigFix Platform versions 9.2.0 through 9.2.14 and 9.5 through 9.5.9. The issue arises because sensitive information is stored in URL parameters, which can be exposed if URLs are logged or exposed via referrers or browser history. The provided documents confirm the affect...

CVE-2018-1481

IBM BigFix Platform 9.2.0 through 9.2.14 and 9.5 through 9.5.9 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 140763...

CVE-2018-12314

Directory Traversal in downloadwallpaper.cgi in ASUSTOR ADM version 3.1.1 allows attackers to download arbitrary files by manipulating the "file" and "folder" URL parameters...

Deprecate support for authenticating using os_username, os_password as url query parameters

h4. Problem Support for using osusername and ospassword to authenticate when used as url query parameters has been deprecated in Jira 8.0.0. It is possible to disable support for osusername & ospassword as url query parameters for authentication by setting allowUrlParameterValue to false in...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-5386

Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leak...

IBM Security Identity Governance and Intelligence Virtual Appliance Information Disclosure Vulnerability (CNVD-2018-23914)

IBM Security Identity Governance and Intelligence Virtual Appliance is a suite of identity management and governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. A security vulnerability exists...

CVE-2017-1367

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

CVE-2017-1367

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

Information disclosure

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

CVE-2017-1367

Summary (CVE-2017-1367): IBM Security Identity Governance and Intelligence Virtual Appliance (IGI) versions 5.2 through 5.2.3.2 store sensitive information in URL parameters. This can lead to information disclosure if URLs are captured in server logs, the Referer header, or browser history. The I...

CVE-2017-1367

IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 1268...

Security Bulletin: Injection vulnerabilities in WebSphere Lombardi Edition and IBM Business Process Manager (BPM) (CVE-2014-3087)

Summary Service inputs can be passed into callService.do as URL parameters in an XML format. Because of insufficient input validation, XML injection attacks are possible. Vulnerability Details CVE ID: CVE-2014-3087 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager might...

Security Bulletin: Cross Site Scripting Vulnerability in Tivoli Business Service Manager (CVE-2016-0311)

Summary Information about a cross site scription security vulnerability affecting Tivoli Business Service Manager TBSM is published in this security bulletin. Javascript can be appended to TBSM URLs to run server side. URL parameters are not sanitised. Vulnerability Details CVEID: CVE-2016-0311...

Security Bulletin: IBM Atlas eDiscovery Process Management affected by vulnerability due to sensitive information stored in URL parameters.

Summary Atlas eDiscovery Process Management has addressed vulnerability due to sensitive information stored in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. Vulnerability Details CVEID:...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive information stored in URL parameters (CVE-2017-1669)

Summary IBM Security Key Lifecycle Manager stores sensitive information in URL parameter. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. The latest fixpack listed below addresses this issue. Vulnerability...

Security Bulletin: IBM Security Access Manager appliances are affected by an information disclosure vulnerability (CVE-2016-3045)

Summary IBM Security Access Manager appliances store sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. Vulnerability Details CVEID: CVE-2016-3045 DESCRIPTION: IBM...

Security Bulletin: Cross Site Scripting vulnerability in IBM Directory Server (CVE-2014-6100)

Summary The Directory Server Admin UI is vulnerable to cross site scripting which allows remote execution of scripts due to insufficient input validation of URL parameters. Vulnerability Details CVE-ID: CVE-2014-6100 IBM Security Directory Server is vulnerable to cross-site scripting, caused by...