Security Advisory - Multiple Injection Vulnerabilities in UDS

The OceanStor UDS has some vulnerability: Attacker injects JavaScript into patch. After the patch is loaded through the OceanStor DeviceManager, the returned content contains the injected script. After the script is parsed and executed on the OceanStor DeviceManager, information leak occurs...

CVE-2013-6319

IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to bypass intended access restrictions and read content via unspecified vectors...

CVE-2013-6320

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML...

CVE-2013-6318

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2013-6333

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML...

CVE-2013-5468

IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, does not encrypt login requests, which allows remote attackers to obtain sensitive information by sniffing the...

Security feature bypass

IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, does not encrypt login requests, which allows remote attackers to obtain sensitive information by sniffing the...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML...

Directory traversal

Directory traversal vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to read arbitrary files via unspecified...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML...

Security feature bypass

IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to bypass intended access restrictions and read content via unspecified vectors...

Sql injection

SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to execute arbitrary SQL commands via unspecified...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote attackers to inject arbitrary web script or HTML via...

CVE-2013-6333

Cross-site scripting XSS vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to inject arbitrary web script or HTML...

CVE-2013-6333

CVE-2013-6333 describes a cross-site scripting (XSS) vulnerability in IBM Algo One , as implemented in the MetaData Management Tools in UDS 4.7.0–5.0.0 , the ACSWeb in Algo Security Access Control Management 4.7.0–4.9.0 , and ACSWeb in AlgoWebApps 5.0.0 . The issue permits remote authenticated us...

CVE-2013-6331

IBM Algo One contains a SQL injection vulnerability (CVE-2013-6331) in the MetaData Management Tools and related components (UDS 4.7.0–5.0.0; Algo Security Access Control Management 4.7.0–4.9.0; AlgoWebApps 5.0.0). The issue allows remote authenticated users to execute arbitrary SQL commands via ...

CVE-2013-5468

CVE-2013-5468 affects IBM Algo One usage in MetaData Management Tools (UDS 4.7.0–5.0.0) and AlgoWeb components (ACSWeb 4.7.0–4.9.0; AlgoWebApps 5.0.0). The common issue is that login requests are not encrypted, enabling remote attackers to sniff sensitive data on the network. Connected documents ...

CVE-2013-6302

SQL injection vulnerability in IBM Algo One, as used in MetaData Management Tools in UDS 4.7.0 through 5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0 through 4.9.0, and ACSWeb in AlgoWebApps 5.0.0, allows remote authenticated users to execute arbitrary SQL commands via unspecified...

CVE-2013-6301

CVE-2013-6301 is an XSS vulnerability in IBM Algo One used by MetaData Management Tools in UDS 4.7.0–5.0.0, ACSWeb in Algo Security Access Control Management 4.7.0–4.9.0, and ACSWeb in AlgoWebApps 5.0.0. It allows remote authenticated users to inject arbitrary web script or HTML via unspecified v...

CVE-2013-6302

CVE-2013-6302 is a SQL injection vulnerability affecting IBM Algo One as used in MetaData Management Tools (UDS 4.7.0–5.0.0), ACSWeb in Algo Security Access Control Management (4.7.0–4.9.0), and ACSWebApps (5.0.0). The underlying issue allows remote authenticated users to execute arbitrary SQL vi...