CVE-2018-1725
published 2020-11-05CVE-2018-1725: IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440.
PriorityP47low2.3CVSS 3.1
AVLACLPRHUINSUCLINAN
EPSS
0.34%
26.4th percentile
IBM QRadar SIEM 7.3 and 7.4 n a multi tenant configuration could be vulnerable to information disclosure. IBM X-Force ID: 147440.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | qradar_security_information_and_event_manager | — | — |
| ibm | qradar_security_information_and_event_manager | — | — |
| ibm | qradar_security_information_and_event_manager | — | — |
| ibm | qradar_security_information_and_event_manager | 7.3.0 – 7.3.3 | — |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
| ibm | qradar_siem | — | — |
CVSS provenance
nvdv3.12.3LOWCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
nvdv3.03.2LOWCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Bugzilla
CVE-2018-5161 Mozilla: Hang via malformed headers
bugzilla·2018-05-21·CVSS 4.3
CVE-2018-5161 [MEDIUM] CVE-2018-5161 Mozilla: Hang via malformed headers
CVE-2018-5161 Mozilla: Hang via malformed headers
Crafted message headers can cause a Thunderbird process to hang on receiving the message.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5161
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726
Bugzilla
CVE-2018-5162 Mozilla: Encrypted mail leaks plaintext through src attribute
bugzilla·2018-05-21·CVSS 7.5
CVE-2018-5162 [HIGH] CVE-2018-5162 Mozilla: Encrypted mail leaks plaintext through src attribute
CVE-2018-5162 Mozilla: Encrypted mail leaks plaintext through src attribute
Plaintext of decrypted emails can leak through the src attribute of remote images, or links.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5162
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726
Bugzilla
CVE-2018-5185 Mozilla: Leaking plaintext through HTML forms
bugzilla·2018-05-21·CVSS 6.5
CVE-2018-5185 [MEDIUM] CVE-2018-5185 Mozilla: Leaking plaintext through HTML forms
CVE-2018-5185 Mozilla: Leaking plaintext through HTML forms
Plaintext of decrypted emails can leak through by user submitting an embedded form.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5185
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726
Bugzilla
CVE-2018-5184 Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack
bugzilla·2018-05-21·CVSS 7.5
CVE-2018-5184 [HIGH] CVE-2018-5184 Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack
CVE-2018-5184 Mozilla: Full plaintext recovery in S/MIME via chosen-ciphertext attack
Using remote content in encrypted messages can lead to the disclosure of plaintext.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5184
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726
Bugzilla
CVE-2018-5170 Mozilla: Filename spoofing for external attachments
bugzilla·2018-05-21·CVSS 4.3
CVE-2018-5170 [MEDIUM] CVE-2018-5170 Mozilla: Filename spoofing for external attachments
CVE-2018-5170 Mozilla: Filename spoofing for external attachments
It is possible to spoof the filename of an attachment and display an arbitrary attachment name. This could lead to a user opening a remote attachment which is a different file type than expected.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2018-13/#CVE-2018-5170
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2018:1725 https://access.redhat.com/errata/RHSA-2018:1725
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2018:1726 https://access.redhat.com/errata/RHSA-2018:1726
2020-11-05
Published