CVE-2023-24975

IBM Spectrum Symphony 7.3 is vulnerable to HTTP header injection due to improper validation of the HOST header. This can enable attackers to perform attacks such as cross-site scripting, cache poisoning, or session hijacking. The issue is documented as CVE-2023-24975. According to IBM’s bulletin,...

CVE-2018-1595

CVE-2018-1595 affects IBM Platform Symphony and IBM Spectrum Symphony. Concrete details in connected sources show a Remote Command Execution flaw caused by improper handling of user input, enabling an authenticated user to execute arbitrary commands. Affected products/versions include Platform Sy...

CVE-2018-1702

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are affected by a XML External Entity Injection (XXE) when processing XML data. A remote attacker could exploit this to disclose sensitive information or exhaust memory resources. Root cause is XXE in XML ...

CVE-2018-1704

IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1, and IBM Spectrum Symphony 7.1.2 and 7.2.0.2 are affected by CVE-2018-1704, an open redirect vulnerability that enables a remote attacker to conduct phishing by tricking a user into visiting a crafted site and spoofing the URL to redirect to a malici...

CVE-2018-1706

IBM Spectrum Symphony 7.2.0.2 is vulnerable to cross-site scripting in the Web UI, allowing a user to embed arbitrary JavaScript and potentially disclose credentials within a trusted session. CVSS v3 base score 5.4 (network, low complexity, user interaction required, privileges LOW; scope CHANGED...

CVE-2018-1705

CVE-2018-1705 affects IBM Platform Symphony 7.1 Fix Pack 1 and 7.1.1 and IBM Spectrum Symphony 7.1.2 and 7.2.0.2. It is an information disclosure vulnerability that could allow an authenticated attacker to obtain highly sensitive information. Remediation is available via IBM Fix Central for the l...