7458 matches found
CVE-2016-3032: Improper Neutralization of Input During Web Page Generation
IBM Cognos Analytics 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 114516...
CVE-2016-5888: Improper Neutralization of Input During Web Page Generation
IBM Interact 8.6, 9.0, 9.1, and 10.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 115084...
PT-2017-8859
Name of the Vulnerable Software and Affected Versions IBM Rational Quality Manager affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...
PT-2017-8804
Name of the Vulnerable Software and Affected Versions IBM Interact versions 8.6 through 10.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...
PT-2017-8307
Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics version 11.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...
Cross site scripting
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3161
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
CVE-2017-3161
CVE-2017-3161 affects Apache Hadoop’s HDFS web UI (pre-2.7.0). The vulnerability is a cross-site scripting flaw caused by an unescaped query parameter, enabling a remote attacker to run scripts in the victim’s browser (potential cookie theft) via specially crafted URLs. The connected documents co...
PT-2017-15694
Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 2.7.0 Description The issue concerns a cross-site scripting XSS attack. It occurs through an unescaped query parameter in the HDFS web UI. This allows for potential malicious script injection and execution...
CVE-2017-3161: Improper Neutralization of Input During Web Page Generation
The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting XSS attack through an unescaped query parameter...
Command injection
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
Design/Logic Flaw
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
CVE-2017-8050
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
CVE-2017-8050
Tenable Appliance 4.4.0, and possibly prior, contains a flaw in the Web UI that allows for the unauthorized manipulation of the admin password...
CVE-2017-8051
CVE-2017-8051 affects Tenable Appliance 3.5–4.4.0 (and possibly earlier) via the simpleupload.py Web UI. The flaw allows arbitrary command execution by manipulating the tns_appliance_session_user parameter, enabling unauthenticated, remote code execution as described in multiple sources (e.g., Re...
CVE-2017-8051
Tenable Appliance 3.5 - 4.4.0, and possibly prior versions, contains a flaw in the simpleupload.py script in the Web UI. Through the manipulation of the tnsappliancesessionuser parameter, a remote attacker can inject arbitrary commands...
