CVE-2018-1905
published 2018-11-26CVE-2018-1905: IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote…
PriorityP341high7.1CVSS 3.0
AVNACLPRLUINSUCHINAL
EPSS
2.53%
83.2th percentile
IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | — | — |
| ibm | websphere_application_server | 9.0.0.0 – 9.0.0.9 | — |
CVSS provenance
nvdv3.07.1HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-94ch-w8wc-29rx: IBM WebSphere Application Server 9
ghsa_unreviewed·2022-05-13
CVE-2018-1905 [HIGH] CWE-611 GHSA-94ch-w8wc-29rx: IBM WebSphere Application Server 9
IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.
Red Hat
wireshark: Out-of-bounds Read in packet-ieee1905.c
vendor_redhat·2018-05-02·CVSS 7.5
CVE-2018-11354 [HIGH] CWE-125 wireshark: Out-of-bounds Read in packet-ieee1905.c
wireshark: Out-of-bounds Read in packet-ieee1905.c
In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
Package: wireshark (Red Hat Enterprise Linux 5) - Not affected
Package: wireshark (Red Hat Enterprise Linux 6) - Not affected
Package: wireshark (Red Hat Enterprise Linux 7) - Not affected
Package: wireshark (Red Hat Enterprise Linux 8) - Not affected
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/106030https://exchange.xforce.ibmcloud.com/vulnerabilities/152534https://www.ibm.com/support/docview.wss?uid=ibm10738721http://www.securityfocus.com/bid/106030https://exchange.xforce.ibmcloud.com/vulnerabilities/152534https://www.ibm.com/support/docview.wss?uid=ibm10738721
2018-11-26
Published