CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session...

CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session...

CVE-2019-1807

The CVE-2019-1807 issue affects the Cisco Umbrella Dashboard web UI. It arises from session management: when a user authenticates and changes credentials in another active session, the app does not invalidate the existing session. An attacker with a separate, authenticated session could access th...

CVE-2019-1807: Session Fixation

A vulnerability in the session management functionality of the web UI for the Cisco Umbrella Dashboard could allow an authenticated, remote attacker to access the Dashboard via an active, user session. The vulnerability exists due to the affected application not invalidating an existing session...

Cisco IOS XE Software Arbitrary File Upload Vulnerability

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the web UI framework of Cisco IOS XE Software could allow an authenticated, remote attacker to make unauthorized changes to the filesystem of the affected device.The vulnerability is due to improper...

Information Disclosure

The pcs packages provide a command-line tool and a web UI to configure and manage the Pacemaker and Corosync tools. It was found that the pcs daemon did not sign cookies containing session data that were sent to clients connecting via the pcsd web UI. A remote attacker could use this flaw to forg...

Multiple Cross-site Scripting (XSS)

Spacewalk Web-UI and Red Hat Satellite 5.7 is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because it does not properly sanitize parameters in systems/SystemEntitlements.do; and admin/multiorg/EntitlementDetails.do, allowing the attacker to inject arbitrary script...

CVE-2019-4258

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross site scripting

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Cross site scripting

IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177...

CVE-2018-1933

IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177...

CVE-2019-4258

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2019-4258

Summary: CVE-2019-4258 affects IBM Sterling B2B Integrator Standard Edition (versions 6.0.0.0 and 6.0.0.1). The vulnerability is a cross-site scripting flaw in the Web UI that could let an attacker embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session....

CVE-2018-1933

CVE-2018-1933 affects IBM Planning Analytics 2.0 through 2.0.6, with a cross-site scripting vulnerability in the Web UI that could allow an attacker to inject JavaScript and potentially disclose credentials within a trusted session. The IBM Security Bulletin notes remediation in IBM Planning Anal...

CVE-2018-1933: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177...

CVE-2019-4258: Improper Neutralization of Input During Web Page Generation

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 Standard Edition is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2019-9789

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics versions 2.0 through 2.0.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessi...

PT-2019-2050

Name of the Vulnerable Software and Affected Versions Cisco Umbrella Dashboard affected versions not specified Description A vulnerability in the session management functionality of the Cisco Umbrella Dashboard's web UI could allow an authenticated, remote attacker to access the Dashboard via an...

Cross site scripting

IBM Jazz Reporting Service JRS 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2018-2004

IBM Jazz Reporting Service JRS 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...