CVE-2017-1792
published 2018-07-10CVE-2017-1792: IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary…
PriorityP423medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.66%
47.3th percentile
IBM Rational Quality Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 137037.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | — | — |
| ibm | rational_quality_manager | 5.0 – 5.0.2 | — |
| ibm | rational_quality_manager | 6.0 – 6.0.5 | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Bugzilla
CVE-2017-10105 Oracle JDK: unspecified vulnerability fixed in 6u161, 7u151, and 8u141 (Deployment)
bugzilla·2017-07-19·CVSS 4.3
CVE-2017-10105 [MEDIUM] CVE-2017-10105 Oracle JDK: unspecified vulnerability fixed in 6u161, 7u151, and 8u141 (Deployment)
CVE-2017-10105 Oracle JDK: unspecified vulnerability fixed in 6u161, 7u151, and 8u141 (Deployment)
Oracle Java SE 6u161, 7u151, and 8u141 fixes an unspecified vulnerability in the Deployment component (CVE-2017-10105). Upstream has CVSS scored this issue as: 4.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
External Reference:
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
Discussion:
This issue has been addressed in the following products:
Oracle Java for Red Hat Enterprise Linux 6
Oracle Java for Red Hat Enterprise Linux 7
Via RHSA-2017:1792 https://access.redhat.com/errata/RHSA-2017:1792
---
This issue has been addressed in the following products:
Oracle Java for Red Hat Enterprise Linux 7
Oracle Java for Red Hat Enterprise Linux 6
Via
Bugzilla
CVE-2017-10081 OpenJDK: incorrect bracket processing in function signature handling (Hotspot, 8170966)
bugzilla·2017-07-17·CVSS 4.3
CVE-2017-10081 [MEDIUM] CVE-2017-10081 OpenJDK: incorrect bracket processing in function signature handling (Hotspot, 8170966)
CVE-2017-10081 OpenJDK: incorrect bracket processing in function signature handling (Hotspot, 8170966)
A flaw was found in the way the Hotspot component of OpenJDK processed extraneous brackets in function signatures. An untrusted Java application or applet could use this flaw to bypass Java certain sandbox restrictions.
Discussion:
Public now via Oracle CPU July 2017:
http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html#AppendixJAVA
The issue was fixed in Oracle JDK 8u141, 7u151, and 6u161.
---
OpenJDK-8 upstream commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/09eae0bade20
---
This issue has been addressed in the following products:
Oracle Java for Red Hat Enterprise Linux 6
Oracle Java for Red Hat Enterprise Linux 7
Via RHSA-2017:1792 https://acc
2018-07-10
Published