CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7683

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files...

Code injection

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7681

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7683

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files...

CVE-2018-7679

CVE-2018-7679 is a remote code execution vulnerability in Micro Focus SBM. Connected CNVD/NVD entries describe SBM versions prior to 11.4 where ASP.NET is configured with execute permission on virtual directories and user avatar images are not validated, enabling an attacker to run arbitrary code...

CVE-2018-7680

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values...

CVE-2018-7680

The CVE-2018-7680 entry concerns Micro Focus Solutions Business Manager versions prior to 11.4, where the product can reflect back HTTP header values. This is supported by NVD data (reflect back HTTP header values) and CNVD/PRION/other entries referencing SBM pre-11.4. The connected documents do ...

CVE-2018-7679

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution...

PT-2018-18206

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue allows HTTP header values to be reflected back, which can be used to manipulate user sessions or conduct further attacks. Recommendations For versions prior to...

CVE-2018-7681: Improper Neutralization of Input During Web Page Generation

Micro Focus Solutions Business Manager versions prior to 11.4 allows JavaScript to be embedded in URLs placed in "Favorites" folder. If the user has certain administrative privileges then this vulnerability can impact other users in the system...

CVE-2018-7683: Insertion of Sensitive Information into Log File

Micro Focus Solutions Business Manager versions prior to 11.4 might reveal certain sensitive information in server log files...

CVE-2018-7679: Improper Input Validation

Micro Focus Solutions Business Manager versions prior to 11.4 when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, could lead to remote code execution...

PT-2018-18205

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue arises when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, which could lead...

PT-2018-18207

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue allows JavaScript to be embedded in URLs placed in the "Favorites" folder. If a user has certain administrative privileges, this can impact other users in the...

PT-2018-18209

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4 Description The issue might cause certain sensitive information to be revealed in server log files. Recommendations For versions prior to 11.4, update to version 11.4 or later to...

CVE-2018-7680: Improper Neutralization of Input During Web Page Generation

Micro Focus Solutions Business Manager versions prior to 11.4 can reflect back HTTP header values...

Security Bulletin: Vulnerability in Apache Batik affects IBM Maximo Asset Management (CVE-2017-5662)

Summary Apache Batik used by IBM Maximo Asset Management could allow a remote authenticated attacker to obtain sensitive information, caused by an XML external entity XXE error when processing XML data. By using a specially-crafted SVG file, a remote attacker could exploit this vulnerability to...

Security Bulletin: IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks (CVE-2017-1357)

Summary IBM Maximo Asset Management could allow an authenticated user to manipulate work orders to forge emails which could be used to conduct further advanced attacks. Vulnerability Details CVEID: CVE-2017-1357 DESCRIPTION: IBM Maximo Asset Management could allow an authenticated user to...

Security Bulletin: IBM Maximo Asset Management is vulnerable to SQL injection(CVE-2017-1175)

Summary IBM Maximo Asset Management is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. Vulnerability Details CVEID: CVE-2017-1175 DESCRIPTION: IBM Maximo...