Security Bulletin: IBM Cúram Social Program Management contains a stored cross-site scripting vulnerability (CVE-2018-1900)

Summary A recent product penetration test identified that a stored cross-site scripting vulnerability exists in IBM Cúram Social Program Management. The issue relates to the rendering of some rich text fields if they pass through the same infrastructure, renderer, or converter where malicious...

IBM Cúram Social Program Management Cross-Site Scripting Vulnerability (CNVD-2018-26360)

IBM Cúram Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A cross-site scripting vulnerability exists in IBM Cúram SPM, which can be exploited by remote attackers to inject...

CVE-2018-1900

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1654

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL...

Cross site scripting

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Open redirect

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL...

CVE-2018-1654

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL...

CVE-2018-1900

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1900

CVE-2018-1900 is a stored cross-site scripting vulnerability in IBM Cúram Social Program Management. IBM’s bulletin lists affected versions: 6.0.5.x, 6.1.0.x–6.1.1.x, 6.2.0.x, 7.0.1, 7.0.3 (and 7.0.2.x–7.0.4.x in 7.0 line). The issue arises in rendering rich text fields when content can pass thro...

CVE-2018-1654

IBM Cúram Social Program Management CVE-2018-1654 is an open redirect vulnerability that enables a remote attacker to perform phishing by spoofing the displayed URL and redirecting users to a malicious site. Affected IBM Cúram SPM versions span 6.0.5.0–6.2.0.6, 7.0.0.0–7.0.3.0, with remediation g...

CVE-2018-1900: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1654: URL Redirection to Untrusted Site

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL...

PT-2018-14757

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, 7.0.1, 7.0.3 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

PT-2018-13619

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0.5, 6.1.1, 6.2.0, 7.0.1, 7.0.3 Description The issue allows a remote attacker to conduct phishing attacks using an open redirect attack. By persuading a victim to visit a specially-crafted Web...

CVE-2018-1671

IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951...

CVE-2018-1671

CVE-2018-1671 affects IBM Curam Social Program Management 7.0.3, via the Social Program Management Design System HTML injection vulnerability. The Design System component (versions prior to 1.4.0) allows remote HTML injection executed in the victim’s browser within the hosting site’s security con...

CVE-2018-1671

IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951...

PT-2018-13697

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management version 7.0.3 Description The issue allows a remote attacker to inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2018-1671: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 7.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-force ID: 144951...

Security Bulletins for Emptoris Program Management

Question Security Bulletins for Emptoris Program Management Answer This article tracks all Security Bulletins for Emptoris Program Management. IBM's Product Security Incident Response Team PSIRT follows the NIST guidelines for determining the severity rating of the reported vulnerability - see "N...