CVE-2018-1688

Summary (CVE-2018-1688) IBM Jazz Foundation, used by CLM 5.0–6.0.6, is vulnerable to cross-site scripting in the Web UI, potentially allowing a trusted-session credential disclosure. The issue affects multiple CLM-related products built on IBM Jazz technology. Remediation is available via upgrade...

CVE-2018-1824

IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2018-1763

IBM Rational Quality Manager versions 5.0–6.0.6 are affected by a cross-site scripting vulnerability in the Web UI that can let an attacker embed arbitrary JavaScript and potentially disclose credentials in a trusted session. Affected products: Rational Quality Manager 5.0–5.0.2 and 6.0–6.0.6 (RQ...

CVE-2018-1825

CVE-2018-1825 affects IBM Rational Quality Manager (RQM) 5.0–6.0.6. A cross-site scripting vulnerability lets an attacker embed arbitrary JavaScript in the Web UI, potentially disclosing credentials in a trusted session. The issue also affects Rational Collaborative Lifecycle Management 5.0–6.0.6...

CVE-2018-1824

CVE-2018-1824 affects IBM Rational Quality Manager (RQM) components in Rational CLM/RQM 5.0–6.0.6. The vulnerability is a cross-site scripting issue in the Web UI that allows embedding arbitrary JavaScript, potentially altering functionality and leading to credential disclosure within a trusted s...

CVE-2018-1825

IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2018-1823

IBM Rational Quality Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2018-1688

IBM Jazz Foundation IBM Rational Collaborative Lifecycle Management 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

Telerik Web UI Information Disclosure (CVE-2017-9248)

A security bypass vulnerability exists in Telerik Web UI. Successful exploitation of this vulnerability can lead to cross-site scripting, arbitrary file uploads and downloads, leak of MachineKey and compromise of the ASP.NET ViewState on the affected system...

Security Bulletin: Cross-site scripting vulnerability in IBM Robotic Process Automation with Automation Anywhere (CVE-2018-1908)

Summary IBM Robotic Process Automation with Automation Anywhere is vulnerable to cross-site scripting Vulnerability Details CVEID: CVE-2018-1908 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere is vulnerable to cross-site scripting. This vulnerability allows users to embed...

StackStorm Cross-Site Scripting Vulnerability

StackStorm is an event-driven automation platform. The platform is used for automated remediation, security response, troubleshooting, and program deployment functions.Web UI is one of the web-based user graphical interfaces. A security vulnerability exists in st2web in StackStorm Web UI versions...

CVE-2019-9580

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS...

CVE-2019-9580

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS...

CVE-2019-9580

In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" origin value, potentially leading to XSS...

CVE-2019-9580

CVE-2019-9580 affects StackStorm’s Web UI (st2web) prior to versions 2.9.3 and 2.10.x prior to 2.10.3. The root cause is improper handling of CORS headers, where an unknown/null origin could be accepted, potentially enabling XSS and related cross-domain actions via a crafted link. Exploitation de...

CVE-2019-4030

IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Cross site scripting

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1911

IBM DOORS Next Generation DNG/RRC 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2018-1912

IBM DOORS Next Generation DNG/RRC 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...

Cross site scripting

IBM DOORS Next Generation DNG/RRC 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Forc...