IBM Tivoli Netcool Service Quality Manager跨站脚本及HTML代码注入漏洞

BUGTRAQ ID: 32233 IBM Tivoli Netcool Service Quality Manager是IBM Tivoli服务质量管理解决方案的核心软件。 Tivoli Netcool Service Quality Manager的Web接口中存在多个跨站脚本漏洞，已认证的用户可以使用报表生成功能创建名称中嵌入了恶意代码的报表，当在主面板中打开报表历史时就会在用户浏览器会话中执行注入的代码。 至少有以下三个页面存在漏洞： http://server/document root/ReportTree http://server/document root/Launch...

IBM Tivoli Netcool Service Quality Manager - Cross-Site Scripting HTML Injection

IBM Tivoli Netcool Service Quality Manager - Cross-Site Scripting HTML Injection source: https://www.securityfocus.com/bid/32233/info IBM Tivoli Netcool Service Quality Manager is prone to multiple cross-site scripting and an HTML-injection vulnerability because it fails to sufficiently sanitize...

IBM Tivoli Netcool Service Quality Manager - Cross-Site Scripting / HTML Injection

source: https://www.securityfocus.com/bid/32233/info IBM Tivoli Netcool Service Quality Manager is prone to multiple cross-site scripting and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data. Attacker-supplied HTML or JavaScript code could run in the...

CVE-2008-4294

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun...

Design/Logic Flaw

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun...

CVE-2008-4294

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 preserves cached user privileges after logout, which allows physically proximate attackers to hijack a session by visiting an unattended workstation, as demonstrated by a root session that is still valid after a subsequent read-only session has begun...

CVE-2008-4294

IBM Tivoli Netcool/Webtop 2.1 before 2.1.0.5 has a local-privilege/session-management flaw: it preserves cached user privileges after logout, enabling a physically proximate attacker to hijack a session by visiting an unattended workstation, with a root session remaining valid after a subsequent ...

Authentication flaw

IBM Tivoli Netcool Security Manager 1.3.0 before Interim Fix 1, when using Active Directory AD LDAP authentication, allows remote attackers to obtain login access via unspecified vectors without entering a password...

CVE-2007-6363

IBM Tivoli Netcool Security Manager 1.3.0 before Interim Fix 1, when using Active Directory AD LDAP authentication, allows remote attackers to obtain login access via unspecified vectors without entering a password...

CVE-2007-6363

IBM Tivoli Netcool Security Manager 1.3.0 is affected by CVE-2007-6363: before Interim Fix 1, AD LDAP authentication allows remote attackers to obtain login access without a password via unspecified vectors. This impacts authentication bypass with AD LDAP and could permit unauthorized access. A f...

CVE-2007-6363

IBM Tivoli Netcool Security Manager 1.3.0 before Interim Fix 1, when using Active Directory AD LDAP authentication, allows remote attackers to obtain login access via unspecified vectors without entering a password...

CVE-2007-6219

Cross-site scripting XSS vulnerability in IBM Tivoli Netcool Security Manager 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Tivoli Netcool Security Manager 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-6219

Cross-site scripting XSS vulnerability in IBM Tivoli Netcool Security Manager 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-6219

The CVE-2007-6219 entry concerns IBM Tivoli Netcool Security Manager 1.3.0 and describes a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents confirm the affected product/version and the XSS...

CVE-2006-1210

The web interface for IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 includes the MySQL database username and password in cleartext in body.phtml, which allows remote attackers to gain privileges by reading the source. NOTE: IBM has privately confirmed to CVE that a fix is available for these...

Design/Logic Flaw

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. NOTE: IBM has private...

CVE-2006-1211

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 configures a MySQL database to allow connections from any source IP address with the ns database account, which allows remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. NOTE: IBM has private...

CVE-2006-1211

IBM Tivoli Micromuse Netcool/NeuSecure 3.0.236 is vulnerable: it configures a MySQL database to allow connections from any source IP address using the ns account, enabling remote attackers to bypass the Netcool/NeuSecure application layer and perform unauthorized database actions. The note indica...

CVE-2006-1210

The CVE-2006-1210 issue affects IBM Tivoli Netcool/NeuSecure 3.0.236, where the web interface stores the MySQL username and password in cleartext within body.phtml, allowing remote attackers to gain privileges by reading the source. Root cause: credentials exposed in the web page source. Impact: ...