CVE-2018-1560
published 2018-09-25CVE-2018-1560: IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to…
PriorityP423medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.66%
47.3th percentile
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142958.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | — | — |
| ibm | rational_engineering_lifecycle_manager | 5.0 – 5.0.2 | — |
| ibm | rational_engineering_lifecycle_manager | 6.0 – 6.0.6 | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
vendor_cisco5.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wwm4-9m5f-88qw: IBM Rational Engineering Lifecycle Manager 5
ghsa_unreviewed·2022-05-13
CVE-2018-1560 [MEDIUM] CWE-79 GHSA-wwm4-9m5f-88qw: IBM Rational Engineering Lifecycle Manager 5
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142958.
Cisco
Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
vendor_cisco·2018-10-17·CVSS 5.8
CVE-2018-0381 [MEDIUM] CWE-667 Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
A vulnerability in the Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition.
The vulnerability is due to a deadlock condition that may occur when an affected AP attempts to dequeue aggregated traffic that is destined to an attacker-controlled wireless client. An attacker who can successfully transition between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating the required traffic patterns could trigger the deadlock condition. A watchdog timer that detects the condition will trigger a reload of th
Cisco
Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
vendor_cisco·2018-05-02·CVSS 4.1
CVE-2018-0250 [MEDIUM] CWE-693 Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL).
The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL.
There are workarounds that address this vulnerability.
This advisory is available at the following link:
http
Cisco
Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0381 Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
CVE-2018-0381: Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points Denial of Service Vulnerability
A vulnerability in the Cisco Aironet 1560, 1800, 2800, and 3800 Series Access Points (APs) software could allow an authenticated, adjacent attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. The vulnerability is due to a deadlock condition that may occur when an affected AP attempts to dequeue aggregated traffic that is destined to an attacker-controlled wireless client. An attacker who can successfully transition between multiple Service Set Identifiers (SSIDs) hosted on the same AP while replicating the required traffic patterns could trigger the deadlock condition. A watchdog timer that detects the condition will trigger
Cisco
Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0250 Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
CVE-2018-0250: Cisco Aironet Access Points Central Web Authentication FlexConnect Client ACL Bypass Vulnerability
A vulnerability in Central Web Authentication (CWA) with FlexConnect Access Points (APs) for Cisco Aironet 1560, 1810, 1810w, 1815, 1830, 1850, 2800, and 3800 Series APs could allow an authenticated, adjacent attacker to bypass a configured FlexConnect access control list (ACL). The vulnerability is due to the AP ignoring the ACL download from the client during authentication. An attacker could exploit this vulnerability by connecting to the targeted device with a vulnerable configuration. A successful exploit could allow the attacker to bypass a configured client FlexConnect ACL. There are
CVSS: 3.0
CWE: CWE-693, CWE-693
Bug IDs: CSCve17756
No detection rules found.
No writeups or analysis indexed.
2018-09-25
Published