IBM Patches Reflected XSS in Worklight, MobileFirst

IBM fixed a cross-site scripting vulnerability in two products last month that could have let an attacker execute malicious JavaScript code in a victim’s browser to steal sensitive information, or user credentials. The vulnerability CVE-2017-1500 lingered in the products, Worklight and MobileFirs...

IBM Worklight Cross-Site Scripting Vulnerability

IBM Worklight is a suite of solutions for developing, testing, managing and securing HTML5, hybrid and native mobile applications from IBM USA. A cross-site scripting vulnerability exists in IBM Worklight. A remote attacker can inject arbitrary JavaScript code into the Web UI...

CVE-2017-1500

A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get a...

Cross site scripting

A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get a...

CVE-2017-1500

A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get a...

CVE-2017-1500

A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get a...

CVE-2017-1500

IBM Worklight/MobileFirst Platform Foundation is affected by CVE-2017-1500: a Reflected XSS in the RESTful Web Api authorization function where the scope parameter can reflect arbitrary JavaScript if a realm not defined in authenticationConfig.xml is used, potentially enabling credential disclosu...

CVE-2017-1500: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting XSS vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1, 6.2, 6.3, 7.0, 7.1, and 8.0. The vulnerable parameter is "scope"; if you set as its value a "realm" not defined in authenticationConfig.xml, you get a...

PT-2017-13811

Name of the Vulnerable Software and Affected Versions IBM Worklight Framework versions 6.1 through 8.0 Description A Reflected Cross Site Scripting XSS issue exists in the authorization function of the RESTful Web Api. The scope parameter is vulnerable; if its value is set to a "realm" not define...

CVE-2014-0888

IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors...

CVE-2014-0888

IBM Worklight Foundation 5.x and 6.x prior to 6.2.0.0 are affected by CVE-2014-0888, which allows bypassing the client-side application authenticity verification under certain conditions. Affected products/versions include Worklight Foundation and IBM Mobile Foundation Consumer/Enterprise Edition...

CVE-2014-0888

IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors...

Authentication flaw

IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors...

PT-2014-3922

Name of the Vulnerable Software and Affected Versions IBM Worklight Foundation versions 5.x through 6.1.x Description The issue allows remote authenticated users to bypass the application-authenticity feature. Recommendations For IBM Worklight Foundation versions 5.x through 6.1.x, update to...

CVE-2014-0888: Undefined Security Weakness

IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors...