CVE-2019-4260

IBM Daeja ViewONE Virtual 5.0–5.0.5 has an information disclosure vulnerability (CVE-2019-4260) that could let an unauthenticated user download server files. Impacted product: Daeja ViewONE Professional/Standard/Virtual 5.0–5.0.5. Root cause: improper handling allowing unauthorized file access. R...

CVE-2017-1209

CVE-2017-1209 affects IBM Daeja ViewONE Professional, Standard and Virtual (versions 4.1.5.1 and 5.0.2 in scope). The underlying issue is a cross-site scripting flaw that allows an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted...

CVE-2019-4246

CVE-2019-4246 affects IBM Daeja ViewONE Virtual 5.0–5.0.6, where internal parameters are exposed to ViewONE clients, enabling possible follow-on attacks. IBM’s bulletin confirms the issue and lists remediation: upgrading to Daeja ViewONE Virtual 5.0.6 iFix 4 or 5.0.5 iFix15 addresses the vulnerab...

CVE-2017-1210

CVE-2017-1210 affects IBM Daeja ViewONE Professional, Standard & Virtual (versions 4.1.5.1 and 5.0.2 as noted in the IBM bulletin; specifically 4.1.5 and 5.0.0/Virtual 5.0.0 area referenced for remediation). The issue allows an unauthenticated attacker to inject data into log files that appear le...

CVE-2017-1308

Summary of CVE-2017-1308 : IBM Daeja ViewONE products (Standard, Professional & Virtual) are affected. The vulnerability involves improper access controls that could allow an authenticated attacker to download files they should not access. Affected versions include IBM Daeja ViewONE Standard, Pro...

CVE-2017-1212

Affected products and issue. IBM Daeja ViewONE Professional, Standard & Virtual versions 4.1.5.1 and 5.0.2 are vulnerable to a denial of service when viewing or opening a large file (CVE-2017-1212). The root cause is not elaborated beyond the documented large-file handling leading to DoS. Impact ...

CVE-2017-1211

IBM Daeja ViewONE Professional, Standard & Virtual 4.1.5.1 and 5.0.2 are affected by a local-information-disclosure when logging is enabled, exposing the user’s session ID in log files/output. Remediation per IBM Security Bulletin: upgrade to Daeja ViewONE 4.1.5.1 iFix022 (for the 4.1.5 lineage) ...

CVE-2018-1835

CVE-2018-1835 affects IBM Daeja ViewONE 5 (Professional, Standard & Virtual). The issue is a XML External Entity (XXE) vulnerability in XML data processing, enabling a remote attacker to disclose sensitive information or cause resource consumption. Affected version: Daeja ViewONE 5; root cause: X...

CVE-2019-4456

The CVE-2019-4456 issue affects IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6. Described vulnerability: XML External Entity Injection (XXE) when processing XML data, enabling a remote attacker to potentially disclose sensitive information or exhaust memory. Affected products ...

CVE-2018-1399

IBM Daeja ViewONE Virtual (and related 4.1.5 and 5.0.x lines) is vulnerable to cross-site scripting via the Web UI, enabling arbitrary JavaScript execution and potentially credentials disclosure within a trusted session. Affected products/versions include IBM Daeja ViewONE Virtual 4.1.5, 5.0.1–5....