CVE-2018-20142

CVE-2018-20142 (reserved CVE) | Affected component: the sharrre library. Vulnerability: Cross-site scripting (XSS) vulnerability in which a remote attacker can inject arbitrary JavaScript into a victim’s browser via the location hash. Impact (as described): attacker could steal session tokens or ...

CVE-2017-11859

Technical details for CVE-2017-11859 are not publicly available in the provided documents. Monitor for updates; no affected products, root cause, or remediation information is disclosed here.

CVE-2023-20099

Technical details for CVE-2023-20099 are not publicly available in the provided documents. Monitor for updates and the release of concrete information on affected products, impact, and remediation.

CVE-2023-23655

CVE-2023-23655 relates to the WordPress plugin MainWP Code Snippets Extension (< =4.0.2). The vulnerability is due to Broken Access Control: there is no authorization check when updating plugin settings, which could let any authenticated user (e.g., a subscriber) modify settings. Affected vers...

UBUNTU-CVE-2023-27655

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2020-24470

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2020. Notes: none...

CVE-2014-4920

The CVE-2014-4920 entry is confirmed to have concrete details in connected documents: the twitter-bootstrap-rails Gem for Rails contains a reflected XSS flaw in the bootstrap_flash helper, caused by inadequate input validation when handling flash messages before rendering to users. This can allow...

CVE-2023-26076

CVE-2023-26076 affects Samsung Exynos mobile chipset/modem family (Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5300, Exynos Auto T5123). The issue is an intra-object overflow in the 5G SM message codec caused by insufficient parameter validation when decoding reserved options, enabl...

CVE-2022-43879

CVE-2022-43879 is an SSRF vulnerability reported by IBM affecting IBM Jazz Team Server (ELM) versions 7.0.1 and 7.0.2, with remediation via iFix022/iFix023. Separate IBM advisories also document the same CVE affecting QRadar WinCollect/WinCollect Agent versions 10.0–10.1.2, with remediation by up...

CVE-2022-4134

Removed by vendor...

CVE-2023-26937

REJECT DO NOT USE THIS CVE RECORD. ConsultIDs: CVE-2019-9587. Reason: This record is a reservation duplicate of CVE-2019-9587. Notes: All CVE users should reference CVE-2019-9587 instead of this record. All references and descriptions in this record have been removed to prevent accidental usage...

CVE-2019-4660

CVE-2019-4660 is an AngularJS client-side template injection vulnerability affecting IBM InfoSphere Information Analyzer and Information Server on Cloud. The issue allows injection of AngularJS template syntax in an internal page request, which can be interpreted by Angular and lead to cross-site...

CVE-2019-4711

CVE-2019-4711 is detailed in IBM’s Security Bulletin for IBM Business Automation Workflow (BAW) 19.0.0.2 with fix JR61324. The issue is an unvalidated TLS certificate import during the registration process to the Resource Registry, allowing a man‑in‑the‑middle attacker to add a signer certificate...

CVE-2018-1966

IBM Security Identity Manager Virtual Appliance (VA) versions 7.0.1–7.0.1.11 are affected by CVE-2018-1966, where error messages disclose sensitive information about the environment, users, or data. This is part of multiple vulnerabilities addressed in the IBM bulletin for ISIM VA, which also lis...

CVE-2019-4504

CVE-2019-4504 affects IBM API Connect (2018 releases). The IBM bulletin notes a vulnerability in API Connect that could inadvertently remove some security patches, potentially exposing the machine to additional attacks. Affected products/versions: IBM API Connect 2018.1–2018.4.1.6. Remediation: f...

CVE-2019-4469

IBM InfoSphere Information Server is confirmed vulnerable to a reflected cross-site scripting (CVE-2019-4469) in the Web UI. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Server on Cloud (11.5, 11.7). The vulnerability allows an attacker to...

CVE-2019-4578

IBM OpenPages GRC Platform (version 8.0) is affected by a cross-site scripting vulnerability (CVE-2019-4578) due to insufficient validation of client-side data. The CNVD entry and IBM security bulletin confirm a stored XSS issue in OpenPages GRC Platform 8.0 with impact on web application context...

CVE-2019-4240

CVE-2019-4240 is a bypass client-side validation vulnerability in IBM Cloud Pak System V2.3.0. An authenticated user with local access could bypass input validation and obtain administrator access due to the lack of server-side validation. IBM has addressed this by upgrading to V2.3.0.1 fixpak fo...

CVE-2019-4432

IBM MQ (including IBM MQ Appliance) is vulnerable to a denial-of-service attack caused by specially crafted messages that can stop queue manager responsiveness and drive high CPU. Affected products and versions include IBM WebSphere MQ v7.1 (7.1.0.0–7.1.0.9), IBM WebSphere MQ v7.5 (7.5.0.0–7.5.0....

CVE-2019-4757

IBM InfoSphere Information Server is vulnerable to cross-site request forgery (CSRF) under CVE-2019-4757. Affected products/versions include IBM InfoSphere Information Server (11.3, 11.5, 11.7) and InfoSphere Information Server on Cloud (11.5, 11.7). The bulletin lists remediation patches and ser...