CVE-2018-1702

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are affected by a XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this to disclose sensitive information or exhaust memory resources. Root cause is XXE in XML ...

Security Bulletin: Remote code execution vulnerability (CVE-2018-1260) affects IBM Spectrum Symphony 7.2.0.2 and 7.2.1

Summary Interim fixes are needed to upgrade the Spring Security OAuth package in IBM Spectrum Symphony 7.2.0.2 and 7.2.1 to resolve the remote code execution vulnerability CVE-2018-1260. Vulnerability Details CVEID: CVE-2018-1260 DESCRIPTION: Pivotal Spring Security OAuth could allow a remote...

@bndynet/bbootstrap (>=1.0.2 <=2.2.1), @bndynet/jslib (>=1.0.52 <=2.0.0) +8 more potentially affected by CVE-2018-16330 via editor.md (=1.5.0)

editor.md NPM version =1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on editor.md and may be impacted: - @bndynet/bbootstrap =1.0.2, =1.0.52, =2.3.6, =1.0.0, =0.2.0, =0.1.1, =0.1.0, =1.0.0, =1.0.3 Source cves: CVE-2018-16330 Source advisory:...

IBM Spectrum Symphony and Platform Symphony Information Disclosure Vulnerabilities

IBM Spectrum Symphony and Platform Symphony are both products of IBM Corporation in the U.S. IBM Spectrum Symphony is a suite of enterprise-class management software for running compute- and data-intensive distributed applications on shared grids.Platform Symphony is a set of SOA-based architectu...

Information disclosure

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340...

CVE-2018-1705

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340...

CVE-2018-1705

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340...

CVE-2018-1705

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 contain an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. IBM X-Force ID: 146340...

CVE-2018-1705

CVE-2018-1705 affects IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2. It is an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. Remediation is available via IBM Fix Central for the l...

IBM Spectrum Symphony and Platform Symphony Command Execution Vulnerabilities

IBM Spectrum Symphony and Platform Symphony are both products of IBM Corporation in the U.S. IBM Spectrum Symphony is a suite of enterprise-class management software for running compute- and data-intensive distributed applications on shared grids.Platform Symphony is a set of SOA-based architectu...

Security Bulletin: XML Entity Expansion vulnerability (CVE-2018-1702) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary XML Entity Expansion vulnerability CVE-2018-1702 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1702 DESCRIPTION: IBM Spectrum Symphony is vulnerable to a XML External Entity Injection XXE attack when processing XML data. A remote attacker could...

Security Bulletin: Stored Cross-Site Scripting (XSS) vulnerability (CVE-2018-1707) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Stored Cross-Site Scripting XSS vulnerability CVE-2018-1707 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1707 DESCRIPTION: IBM Platform Symphony is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri...

Security Bulletin: Vulnerability to allow an authenticated user to obtain sensitive user information (CVE-2018-1708) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Vulnerability to allow an authenticated user to obtain sensitive user information such as passwords through the WebUI CVE-2018-1708 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1708 DESCRIPTION: IBM Spectrum Symphony could allow an authenticat...

Security Bulletin: Reflected Cross-Site Scripting (XSS) vulnerability (CVE-2018-1706) affects IBM Spectrum Symphony 7.2.0.2

Summary Reflected Cross-Site Scripting XSS vulnerability CVE-2018-1706 affects IBM Spectrum Symphony 7.2.0.2 Vulnerability Details CVEID: CVE-2018-1706 DESCRIPTION: IBM Platform Symphony is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t...

Security Bulletin: Arbitrary URL Redirection (CVE-2018-1704) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary URL Redirection CVE-2018-1704 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1704 DESCRIPTION: IBM Platform Symphony could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to...

Security Bulletin: Arbitrary File Reads (CVE-2018-1705) affects IBM Platform Symphony, IBM Spectrum Symphony

Summary Arbitrary File Reads CVE-2018-1705 affects IBM Platform Symphony, IBM Spectrum Symphony Vulnerability Details CVEID: CVE-2018-1705 DESCRIPTION: IBM Platform Symphony contains an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive...

CVE-2018-1595

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

Input validation

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

CVE-2018-1595

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

CVE-2018-1595

CVE-2018-1595 affects IBM Platform Symphony and IBM Spectrum Symphony. Concrete details in connected sources show a Remote Command Execution flaw caused by improper handling of user input, enabling an authenticated user to execute arbitrary commands. Affected products/versions include Platform Sy...