CVE-2016-9732: Improper Neutralization of Input During Web Page Generation

IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

CVE-2017-1195: URL Redirection to Untrusted Site

IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to...

IBM Curam Social Program Management Cross-Site Scripting Vulnerability (CNVD-2017-25505)

IBM Curam Social Program Management SPM is a suite of social program management solutions from IBM USA. The solution supports the process of end-to-end social program delivery. A cross-site scripting vulnerability exists in IBM Curam SPM. A remote attacker can exploit this vulnerability to inject...

CVE-2017-1110

IBM Curam Social Program Management 6.0, 6.1, 6.2, and 7.0 contains an unspecified vulnerability that could allow an authenticated user to view the incidents of a higher privileged user. IBM X-Force ID: 120915...

CVE-2016-9732

IBM Cúram SPM (CVE-2016-9732) is vulnerable to Cross-Site Scripting in the Web UI. Affected versions include 6.0.0.4–6.0.5.x, 6.1.x (up to 6.1.1.x), 6.2.x (up to 6.2.0.4), and 7.0.0.0. The root cause is a reflected/stored XSS vulnerability allowing arbitrary JavaScript in the UI, potentially lead...

CVE-2017-1110

CVE-2017-1110 affects IBM Cúram Social Program Management (SPM) across multiple VMF versions (7.0.0.0–7.0.0.1; 6.2.0.0–6.2.0.4; 6.1.1.0–6.1.1.4; 6.1.0.0–6.1.0.4; 6.0.5.0–6.0.5.10; 6.0.4.0–6.0.4.9). An authenticated user could view the incidents of a higher-privileged user; the vulnerability is un...

CVE-2016-9732

IBM Curam Social Program Management 6.0, 6.1, 6.2 and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...

PT-2017-10298

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 through 7.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

PT-2017-11740

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 through 7.0 Description The issue allows an authenticated user to view the incidents of a higher privileged user. Recommendations For versions 6.0 through 7.0, update to a version that fixes thi...

Code injection

IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors...

CVE-2014-8903

IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors...

CVE-2014-8903

IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors...

CVE-2014-8903

CVE-2014-8903 affects IBM Cúram Social Program Management (versions 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10, and 6.0.5 before 6.0.5.6). Root cause: Java reflection attack where external input specifies a class name, allowing remote authenticated users to load arbitrary Java classes. Impac...

PT-2017-6299

Name of the Vulnerable Software and Affected Versions IBM Curam Social Program Management versions 6.0 SP2 before EP26 IBM Curam Social Program Management versions 6.0.4 before 6.0.4.5iFix10 IBM Curam Social Program Management versions 6.0.5 before 6.0.5.6 Description The issue allows remote...

CVE-2014-8903: Improper Neutralization of Special Elements used in a Command

IBM Curam Social Program Management 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10 and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors...

CVE-2017-1106

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

Cross site scripting

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2017-1106

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2017-1106

IBM Curam Social Program Management 5.2, 6.0, and 7.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

CVE-2017-1106

CVE-2017-1106 affects IBM Cúram Social Program Management versions 5.2.0.0–5.2.0 SP6, 6.0.x, 6.1.x, 6.2.x, and 7.0.x. The vulnerability is a cross‑site scripting flaw in the SWF files shipped with the product, due to a vulnerable Adobe Flex SDK. An attacker could embed arbitrary JavaScript in the...