Security Bulletin: API Connect Developer Portal is affected by cross-site scripting vulnerability (CVE-2018-1430)

Summary API Connect Developer Portal has addressed the following vulnerability. IBM API Connect Developer Portal is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI, thus altering the intended functionality and potentially leadin...

Security Bulletin: Cross-Site Scripting vulnerability in IBM Robotic Process Automation with Automation Anywhere (CVE-2017-1751)

Summary IBM RPA with Automation Anywhere is vulnerable to cross-site scripting. Vulnerability Details CVEID: CVE-2017-1751 DESCRIPTION: IBM Robotic Process Automation with Automation Anywhere is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code...

Security Bulletin: Vulnerability in system log on IBM DataPower Gateways WebGUI (CVE-2017-1591)

Summary A potential cross-site scripting vulnerability exists in the DataPower system log. IBM has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2017-1591 DESCRIPTION: IBM WebSphere DataPower Appliances is vulnerable to cross-site scripting. This vulnerability allows users to emb...

Security Bulletin: Cross-site scripting vulnerability in IBM Business Process Manager (BPM) - CVE-2017-1425

Summary IBM BPM reflects untrusted user input without fully removing HTML markup. This might allow controlling parts of the user interface, possibly script injection. Vulnerability Details CVEID: CVE-2017-1425 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site scripting. This...

Security Bulletin: IBM Development Package for Apache Spark might create a remote exploitation vector against old Internet Explorer browsers through XSS

Summary IBM Development Package for Apache Spark addresses the following vulnerability. The vulnerability is a potential cross-site scripting XSS attack on a Web UI client; server-side analytical processing by Apache Spark is not affected and data is not compromised. Vulnerability Details CVEID:...

Security Bulletin: Cross Site Scripting vulnerability in IBM Business Process Manager (BPM) (CVE-2016-6109)

Summary IBM BPM is vulnerable to cross-site scripting, caused by improper neutralization of user-supplied input in some error situations. Vulnerability Details CVEID: CVE-2016-6109 DESCRIPTION: IBM Business Process Manager is vulnerable to cross-site scripting. This vulnerability allows users to...

Security Bulletin: Cross-site scripting vulnerability in IBM WebSphere Application Server Liberty (CVE-2016-3042)

Summary There is a potential cross-site scripting vulnerability in the WebSphere Application Server Liberty OpenID Connect clients. Vulnerability Details CVEID: CVE-2016-3042 DESCRIPTION: IBM WebSphere Application Server - Liberty is vulnerable to cross-site scripting in OpenID Connect clients...

Siaberry 1.2.2 - Command Injection Vulnerability

Exploit for hardware platform in category web applications Siaberry's Command Injection Vulnerability Today, I’d like to share several interesting vulnerabilities I discovered in Siaberry, a hardware device for earning cryptocurrency. Siaberry runs on Sia, a decentralized marketplace for buying a...

Command injection

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

CVE-2018-6961

CVE-2018-6961 affects VMware NSX SD-WAN Edge by VeloCloud, with a command injection in the local web UI component. Affected versions include SD-WAN Edge prior to 3.1.0; exploitation could lead to remote code execution. Public materials cite in-the-wild exploit tooling and a later fixed release (e...

CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

CVE-2018-6961

VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future...

Cross site scripting

A vulnerability in the web UI of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-frame scripting XFS attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline...

CVE-2018-0355

A vulnerability in the web UI of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-frame scripting XFS attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline...

CVE-2018-0355

Cisco CUCM Web UI is affected by a Cross-Frame Scripting (XFS) vulnerability due to insufficient iframe protections. An unauthenticated, remote attacker could lure a user to an attacker-controlled page containing a malicious iframe, enabling clickjacking or other client-side browser attacks on th...

CVE-2018-0355

A vulnerability in the web UI of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-frame scripting XFS attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline...

Cisco Unified Communications Manager Cross-Frame Scripting Vulnerability

A vulnerability in the web UI of Cisco Unified Communications Manager Unified CM could allow an unauthenticated, remote attacker to conduct a cross-frame scripting XFS attack against the user of the web UI of an affected system. The vulnerability is due to insufficient protections for HTML inline...

Cross site scripting

IBM Content Navigator 2.0.3, 3.0.0, 3.0.1, 3.0.2, and 3.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM...