PT-2017-12993

Name of the Vulnerable Software and Affected Versions IBM Team Concert RTC affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted...

IBM Daeja ViewONE Cross-Site Scripting Vulnerability

IBM Daeja ViewONE is a document viewer from IBM that supports TIFF, PDF and Office-based documents.IBM Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are its different Daeja ViewONE Virtual, Daeja ViewONE Standard and Daeja ViewONE Professional are different versions...

Cross site scripting

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2017-1209

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2017-1209: Improper Neutralization of Input During Web Page Generation

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

PT-2017-12347

Name of the Vulnerable Software and Affected Versions IBM Daeja ViewONE Professional, Standard & Virtual versions 4.1.5.1 and 5.0.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

IBM Content Navigator & CMIS Cross-Site Scripting Vulnerability

IBM Content Navigator & CMIS is a Web client from IBM USA that supports searching and processing documents stored in content servers around the world from a Web browser. A cross-site scripting vulnerability exists in IBM Content Navigator & CMIS versions 2.0.3, 3.0.0 and 3.0.1. A remote attacker...

IBM Rational Engineering Lifecycle Manager Cross-Site Scripting Vulnerability (CNVD-2017-33349)

IBM Rational Engineering Lifecycle Manager RELM is a suite of engineering lifecycle management software from IBM in the United States. A cross-site scripting vulnerability exists in IBM RELM. A remote attacker can exploit this vulnerability to inject arbitrary JavaScript code into the Web UI...

Cross site request forgery (csrf)

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

CVE-2017-15084

The CVE-2017-15084 issue affects Rapid7 Metasploit’s web UI prior to version 4.14.1-20170828, where logout requests are vulnerable to cross-site request forgery (CSRF). An attacker could induce a logged-in user to logout by crafted requests (attack vector shown in public PoCs). The vulnerability ...

CVE-2017-15084: Cross-Site Request Forgery (CSRF)

The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22...

PT-2017-13863

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit versions prior to 4.14.1-20170828 Description The issue concerns a logout CSRF in the web UI. Recommendations For versions prior to 4.14.1-20170828, update to version 4.14.1-20170828 or later to resolve the issue...

CVE-2017-1522

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

Cross site scripting

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

Cross site scripting

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

CVE-2017-1522: Improper Neutralization of Input During Web Page Generation

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force...

CVE-2017-12269: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this...

PT-2017-13915

Name of the Vulnerable Software and Affected Versions IBM Content Navigator & CMIS versions 2.0.3, 3.0.0, and 3.0.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...