CVE-2019-4384

IBM Campaign versions 9.1.2 and 10.1 are affected by a directory traversal vulnerability allowing a remote attacker to view arbitrary files via crafted URLs containing dot-dot sequences (../). Root cause is related to insufficient validation of URL paths, enabling traversal to restricted files. I...

CVE-2017-1114

IBM Campaign versions 9.1, 9.1.2, and 10 are affected by a cross-site scripting flaw in the Web UI. The vulnerability allows an attacker to inject arbitrary JavaScript, potentially altering UI behavior and leading to credentials disclosure within a trusted session. Some sources note remote exploi...

CVE-2017-1116

CVE-2017-1116 affects IBM Campaign 8.6, 9.0, 9.1, 9.1.1, 9.1.2, and 10.0. The issue is that the client stores excessive details which could provide information useful for an authenticated user to conduct other attacks. The available sources describe the root cause as overly verbose client-side da...

CVE-2016-0265

The connected records confirm CVE-2016-0265 affects IBM Campaign and is a cross-site scripting vulnerability caused by improper validation of user-supplied input. A remote attacker can use a specially crafted URL to run script in a victim’s browser within the hosting site’s security context, enab...

CVE-2017-1115

IBM Campaign (Unica Campaign) versions 9.1, 9.1.2, and 10 are affected by an HTML injection vulnerability. A remote attacker could inject malicious HTML that would be executed in a victim’s browser within the hosting site’s security context. The issue is documented across multiple feeds (IBM X-Fo...

CVE-2016-9749

The CVE-2016-9749 entry affects IBM Campaign versions 9.1.0, 9.1.2, 10.0, and 10.1. Affected component: input validation in the application; root cause is lack of input validation. Impact: could allow an authenticated user with access to the local network to bypass security. CVSS data in sources ...

CVE-2018-1941

The CVE-2018-1941 issue affects IBM Campaign versions 9.1.0 and 9.1.2, where a local attacker could obtain administrative privileges because the application fails to validate access permissions. The vulnerability arises from insufficient access-control checks within the product, enabling privileg...

CVE-2018-1921

IBM Campaign (versions 9.1.0–11.0) is reported vulnerable to Cross-Site Scripting in the Web UI, enabling injection of arbitrary JavaScript that could lead to credential disclosure within a trusted session. The CVE notes an XSS issue; exploitation details are not provided in the primary sources. ...