CVE-2017-1333

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 expose an information disclosure vulnerability that allows an unauthenticated user to obtain sensitive server information, which could be used to plan future attacks. The provided documents do not disclose the root cause details, exploit steps, or a sp...

CVE-2017-1300

CVE-2017-1300 concerns cross-site request forgery in IBM OpenPages GRC Platform versions 7.1–7.3. The vulnerability could allow a malicious action to be executed within a trusted user session. The IBM advisory states affected components as the OpenPages GRC Platform and provides remediation by ap...

CVE-2017-1147

IBM OpenPages GRC Platform versions 7.1–7.3 are affected by a cross-site scripting vulnerability in the Web UI. The issue allows injection of arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Remediation: apply fixes as follows—OpenPages 7.3: 7.3 Fix Pa...

PT-2017-12839

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions from a user that th...

PT-2017-12043

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.2 through 7.3 Description The issue allows a user to obtain sensitive information, including private APIs, which could be used in further attacks against the system. Recommendations For IBM OpenPages GRC...

PT-2017-12761

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2017-1333: Exposure of Sensitive Information to an Unauthorized Actor

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that could be used in future attacks against the system. IBM X-Force ID: 126241...

CVE-2017-1147: Improper Neutralization of Input During Web Page Generation

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2017-1148: Exposure of Sensitive Information to an Unauthorized Actor

IBM OpenPages GRC Platform 7.2 and 7.3 with OpenPages Loss Event Entry LEE application could allow a user to obtain sensitive information including private APIs that could be used in further attacks against the system. IBM X-Force ID: 122201...

PT-2017-8316

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2016-3048: Improper Neutralization of Input During Web Page Generation

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

PT-2017-12036

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2017-1300: Cross-Site Request Forgery (CSRF)

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 125162...

PT-2017-12970

Name of the Vulnerable Software and Affected Versions IBM OpenPages GRC Platform versions 7.1 through 7.3 Description The issue could allow an unauthenticated user to obtain sensitive information about the server, which could be used in future attacks against the system. Recommendations For IBM...

CVE-2017-1290: Improper Neutralization of Input During Web Page Generation

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

Design/Logic Flaw

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...

CVE-2016-3049

IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 114712...