CVE-2018-8085

Veracode entry VERACODE:13415 documents a SAML Signature Relocation vulnerability affecting passport-wsfed-saml2. The issue arises because the validation function does not ensure the Signature element is located correctly within an Assertion, enabling signature relocation attacks. The provided ma...

CVE-2018-14578

The connected Veracode entry identifies a concrete vulnerability in yiisoft/yii2: CSRF due to unvalidated request methods in yii\web\Request::getMethod(), allowing an attacker to bypass CSRF token checks by downgrading the HTTP method to read methods such as GET, HEAD or OPTIONS.

CVE-2014-4920

The CVE-2014-4920 entry is confirmed to have concrete details in connected documents: the twitter-bootstrap-rails Gem for Rails contains a reflected XSS flaw in the bootstrap_flash helper, caused by inadequate input validation when handling flash messages before rendering to users. This can allow...

CVE-2017-8231

CVE-2017-8231 is tracked in Arista EOS advisory 0029 and accompanying Nessus entry ARISTA_EOS_SA0029.NASL. Affected: Arista EOS platforms prior to 4.18.1F (various 4.16/4.17 releases listed). Issue: Rib agent restart when processing a malformed MP-BGP update attribute, caused by improper MPBGP up...

CVE-2020-26568

CVE-2020-26568 is confirmed in Arista EOS software affecting multiple EOS releases (4.21.x, 4.22.x, 4.23.x, 4.24.x) with non-default VRFs and configured VXLAN. The issue causes malformed UDP packets to be incorrectly forwarded across VRF boundaries and can disrupt TCP three-way handshakes, impact...

CVE-2020-4339

CVE-2020-4339 is a stored cross-site scripting (XSS) vulnerability reported in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.3.0. It arises from insufficient input validation and missing output encoding, allowing a malicious user-supplied value written to the database/file to be d...

CVE-2019-4664

CVE-2019-4664 affects IBM Spectrum Scale (V5.0.0.0–V5.0.4.0). A local attacker could exploit a specially crafted request to execute arbitrary commands on the system. IBM provides a fix in V5.0.4.1 via Fix Central; no workarounds are listed. Affected product details and remediation are documented ...

CVE-2019-4756

This CVE-2019-4756 entry corresponds to a reflected cross-site scripting vulnerability in IBM InfoSphere Information Server and IBM InfoSphere QualityStage. Affected products and versions: IBM InfoSphere QualityStage (11.3, 11.5, 11.7) and IBM InfoSphere Information Server on Cloud (11.5, 11.7). ...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...

CVE-2018-1965

IBM Security Identity Manager Virtual Appliance (ISIM VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1965, which stems from weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. The bulletin lists remediation via the fix 7.0.1-IS...

CVE-2018-1964

IBM Security Identity Manager Virtual Appliance versions 7.0.1 through 7.0.1.11 are affected by CVE-2018-1964, which could allow a remote attacker to hijack a victim’s click actions by persuading them to visit a malicious site. The issue is tied to an application behavior that enables hijacking v...

CVE-2019-4573

IBM Maximo Asset Management is affected by CVE-2019-4573, where an error message can disclose sensitive information about the environment, users, or related data. Affected versions include Maximo Asset Management core product 7.6 (and dependent Industry Solutions and Control Desk products when in...

CVE-2019-4466

IBM Cloud Pak System V2.3.0 is affected by CVE-2019-4466 in IBM Platform System Manager, where a local user could obtain highly sensitive information stored in JavaScript files. Remediation: upgrade to V2.3.0.1 fixpak as outlined by IBM. There is no exploitation detail provided in the connected d...

CVE-2019-4432

IBM MQ (including IBM MQ Appliance) is vulnerable to a denial-of-service attack caused by specially crafted messages that can stop queue manager responsiveness and drive high CPU. Affected products and versions include IBM WebSphere MQ v7.1 (7.1.0.0–7.1.0.9), IBM WebSphere MQ v7.5 (7.5.0.0–7.5.0....

CVE-2019-4407

CVE-2019-4407 is a confirmed CSRF vulnerability affecting IBM InfoSphere Information Server (and InfoSphere on Cloud) as detailed in IBM’s Security Bulletin. Affected versions: InfoSphere Information Server 11.3, 11.5, 11.7 and InfoSphere Information Server on Cloud 11.5 and 11.7. The issue allow...

CVE-2018-1709

Jazz for Service Management (IBM) versions 1.1.0–1.1.3 are affected by CVE-2018-1709. The IBM bulletin describes a cross-site scripting vulnerability in the Dashboard Application Services Hub that can allow arbitrary JavaScript in the web UI and potential credentials disclosure within a trusted s...

CVE-2018-1995

CVE-2018-1995 is documented in the IBM UrbanCode Deploy bulletin as a vulnerability where authenticated web agents could modify another agent’s properties via a crafted request. Affected products are IBM UrbanCode Deploy Web Agents (versions 6.2.7.3–6.2.7.4 and 7.0–7.0.1.1); JMS-based agents are ...

CVE-2018-1613

CVE-2018-1613 is a confirmed vulnerability in IBM Platform Symphony and IBM Spectrum Symphony involving a vertical authorization bypass in the Symping utility. A local attacker could obtain a privileged token and gain privileges or access highly sensitive data. Affected products/versions: IBM Pla...

CVE-2018-1707

CVE-2018-1707 is a stored cross-site scripting (XSS) vulnerability affecting IBM Platform Symphony and IBM Spectrum Symphony. Affected products/versions: Platform Symphony 7.1 Fix Pack 1 and 7.1.1; Spectrum Symphony 7.1.2 and 7.2.0.2. The vulnerability allows an attacker to embed arbitrary JavaSc...

CVE-2018-1681

CVE-2018-1681 affects IBM Data Science Experience Local. The IBM security bulletin confirms a vulnerability that could disclose highly sensitive information to a local unprivileged user. Affected versions are IBM Data Science Experience Local 1.1.0, 1.1.1, 1.1.2, 1.1.3, and 1.2.0. The remediation...