PT-2018-5589

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Governance and Intelligence Virtual Appliance versions 5.2 through 5.2.3.2 Description: The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorize...

Security Bulletin: Injection vulnerabilities in WebSphere Lombardi Edition and IBM Business Process Manager (BPM) (CVE-2014-3087)

Summary Service inputs can be passed into callService.do as URL parameters in an XML format. Because of insufficient input validation, XML injection attacks are possible. Vulnerability Details CVE ID: CVE-2014-3087 DESCRIPTION: IBM WebSphere Lombardi Edition and IBM Business Process Manager might...

Security Bulletin: Cross Site Scripting Vulnerability in Tivoli Business Service Manager (CVE-2016-0311)

Summary Information about a cross site scription security vulnerability affecting Tivoli Business Service Manager TBSM is published in this security bulletin. Javascript can be appended to TBSM URLs to run server side. URL parameters are not sanitised. Vulnerability Details CVEID: CVE-2016-0311...

Security Bulletin: IBM Atlas eDiscovery Process Management affected by vulnerability due to sensitive information stored in URL parameters.

Summary Atlas eDiscovery Process Management has addressed vulnerability due to sensitive information stored in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. Vulnerability Details CVEID:...

Security Bulletin: IBM Security Key Lifecycle Manager is affected by exposure of sensitive information stored in URL parameters (CVE-2017-1669)

Summary IBM Security Key Lifecycle Manager stores sensitive information in URL parameter. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. The latest fixpack listed below addresses this issue. Vulnerability...

Security Bulletin: IBM Security Access Manager appliances are affected by an information disclosure vulnerability (CVE-2016-3045)

Summary IBM Security Access Manager appliances store sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. Vulnerability Details CVEID: CVE-2016-3045 DESCRIPTION: IBM...

Security Bulletin: Cross Site Scripting vulnerability in IBM Directory Server (CVE-2014-6100)

Summary The Directory Server Admin UI is vulnerable to cross site scripting which allows remote execution of scripts due to insufficient input validation of URL parameters. Vulnerability Details CVE-ID: CVE-2014-6100 IBM Security Directory Server is vulnerable to cross-site scripting, caused by...

Security Bulletin: IBM InfoSphere DataStage exposes sensitive information during certain operations (CVE-2016-8982)

Summary IBM InfoSphere DataStage exposes sensitive information during certain operations. Vulnerability Details CVEID: CVE-2016-8982 DESCRIPTION: IBM InfoSphere Information Server stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have...

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

CVE-2017-5453

CVE-2017-5453 affects Mozilla Firefox

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

CVE-2017-5453: Improper Input Validation

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

EMS Master Calendar Cross Site Scripting

Exploit Title: EMS Master Calendar alert'XSS'xyz...

EMS Master Calendar < 8.0.0.20180520 - Reflected Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: EMS Master Calendar alert'XSS'xyz 0day.today 2018-06-05...

EMS Master Calendar < 8.0.0.20180520 - Cross-Site Scripting

Exploit Title: EMS Master Calendar alert'XSS'xyz...

Cross site scripting

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

CVE-2018-11628

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

CVE-2018-11628

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...

CVE-2018-11628: Improper Neutralization of Input During Web Page Generation

Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized, allowing malicious attackers to send a crafted URL for XSS...