CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
Vulnerability Feeds & WidgetsNew   www.itsecdb.com  

Security Vulnerabilities (CVSS score between 6 and 6.99)

Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
2651 CVE-2018-2412 264 2018-04-10 2018-05-14
6.5
None Remote Low Single system Partial Partial Partial
SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
2652 CVE-2018-2409 384 2018-04-10 2018-05-22
6.5
None Remote Low Single system Partial Partial Partial
Improper session management when using SAP Cloud Platform 2.0 (Connectivity Service and Cloud Connector). Under certain conditions, data of some other user may be shown or modified when using an application built on top of SAP Cloud Platform.
2653 CVE-2018-2401 611 2018-03-14 2018-04-10
6.5
None Remote Low Single system Partial Partial Partial
SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability.
2654 CVE-2018-2395 20 2018-02-14 2018-02-27
6.5
None Remote Low Single system Partial Partial Partial
Under certain conditions a malicious user may retrieve information on SAP Internet Graphic Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, overwrite existing image or corrupt other type of files.
2655 CVE-2018-2381 285 2018-02-14 2018-03-15
6.5
None Remote Low Single system Partial Partial Partial
SAP ERP Financials Information System (SAP_APPL 6.00, 6.02, 6.03, 6.04, 6.05, 6.06, 6.16; SAP_FIN 6.17, 6.18, 7.00, 7.20, 7.30 S4CORE 1.00, 1.01, 1.02) does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
2656 CVE-2018-2380 22 Dir. Trav. 2018-03-01 2018-03-23
6.5
None Remote Low Single system Partial Partial Partial
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
2657 CVE-2018-2367 22 Dir. Trav. 2018-03-01 2018-03-23
6.5
None Remote Low Single system Partial Partial Partial
ABAP File Interface in, SAP BASIS, from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
2658 CVE-2018-2363 94 Exec Code 2018-01-09 2018-01-29
6.5
None Remote Low Single system Partial Partial Partial
SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by executing malicious code without legitimate credentials.
2659 CVE-2018-2361 285 2018-01-09 2018-01-29
6.5
None Remote Low Single system Partial Partial Partial
In SAP Solution Manager 7.20, the role SAP_BPO_CONFIG gives the Business Process Operations (BPO) configuration user more authorization than required for configuring the BPO tools.
2660 CVE-2018-2001 352 CSRF 2019-05-07 2019-05-08
6.8
None Remote Medium Not required Partial Partial Partial
IBM Cram Social Program Management 6.1.1, 6.2.0, 7.0.4, and 7.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154891.
2661 CVE-2018-2000 352 CSRF 2019-04-08 2019-04-15
6.8
None Remote Medium Not required Partial Partial Partial
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 154890.
2662 CVE-2018-1992 119 Overflow 2019-03-21 2019-04-03
6.9
None Local Medium Not required Complete Complete Complete
The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.
2663 CVE-2018-1969 434 2019-01-14 2019-01-16
6.5
None Remote Low Single system Partial Partial Partial
IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750.
2664 CVE-2018-1927 352 CSRF 2018-11-30 2018-12-20
6.8
None Remote Medium Not required Partial Partial Partial
IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118.
2665 CVE-2018-1926 352 CSRF 2018-12-12 2018-12-31
6.8
None Remote Medium Not required Partial Partial Partial
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.
2666 CVE-2018-1901 264 +Priv 2018-12-12 2018-12-31
6.5
None Remote Low Single system Partial Partial Partial
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.
2667 CVE-2018-1888 426 Exec Code 2019-01-04 2019-01-14
6.8
None Remote Medium Not required Partial Partial Partial
An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. IBM X-Force ID: 152079.
2668 CVE-2018-1884 22 Exec Code Dir. Trav. 2018-11-12 2018-12-12
6.8
None Remote Medium Not required Partial Partial Partial
IBM Case Manager 5.2.0.0, 5.2.0.4, 5.2.1.0, 5.2.1.7, 5.3.0.0, and 5.3.3.0 is vulnerable to a "zip slip" vulnerability which could allow a remote attacker to execute code using directory traversal techniques. IBM X-Force ID: 151970.
2669 CVE-2018-1859 264 2019-01-04 2019-01-11
6.5
None Remote Low Single system Partial Partial Partial
IBM API Connect 5.0.0.0 through 5.0.8.4 could allow a user authenticated as an administrator with limited rights to escalate their privileges. IBM X-Force ID: 151258.
2670 CVE-2018-1840 264 +Priv 2018-12-03 2018-12-21
6.8
None Remote Medium Not required Partial Partial Partial
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to gain elevated privileges on the system, caused when a security domain is configured to use a federated repository other than global federated repository and then migrated to a newer release of WebSphere Application Server. IBM X-Force ID: 150813.
2671 CVE-2018-1821 611 2018-12-13 2019-01-02
6.4
None Remote Low Not required Partial None Partial
IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.
2672 CVE-2018-1819 89 Sql 2018-10-04 2018-11-21
6.5
None Remote Low Single system Partial Partial Partial
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2, 3.0.4, 3.0.6, and 3.2.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-force ID: 150023.
2673 CVE-2018-1808 20 2018-11-13 2018-12-12
6.5
None Remote Low Single system Partial Partial Partial
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.
2674 CVE-2018-1790 352 CSRF 2019-05-10 2019-05-10
6.8
None Remote Medium Not required Partial Partial Partial
IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 148944.
2675 CVE-2018-1789 918 2018-09-07 2018-09-21
6.5
None Remote Low Single system Partial Partial Partial
IBM API Connect v2018.1.0 through v2018.3.4 could allow an attacker to send a specially crafted request to conduct a server side request forgery attack. IBM X-Force ID: 148939.
2676 CVE-2018-1774 94 Exec Code 2018-11-08 2018-12-12
6.8
None Remote Medium Not required Partial Partial Partial
IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and 2018.3.6 is vulnerable to CSV injection via the developer portal and analytics that could contain malicious commands that would be executed once opened by an administrator. IBM X-Force ID: 148692.
2677 CVE-2018-1741 20 DoS 2018-10-08 2018-11-28
6.4
None Remote Low Not required None Partial Partial
IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 does not properly limit the number or frequency of interaction which could be used to cause a denial of service, compromise program logic or other consequences. IBM X-Force ID: 148420.
2678 CVE-2018-1699 89 Sql 2018-08-24 2018-10-17
6.5
None Remote Low Single system Partial Partial Partial
IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145968.
2679 CVE-2018-1695 284 2018-09-06 2018-11-01
6.8
None Remote Medium Not required Partial Partial Partial
IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 installations using Form Login could allow a remote attacker to conduct spoofing attacks. IBM X-Force ID: 145769.
2680 CVE-2018-1674 89 Sql 2018-09-20 2018-11-09
6.5
None Remote Low Single system Partial Partial Partial
IBM Business Process Manager 8.5 through 8.6 and 18.0.0.0 through 18.0.0.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 145109.
2681 CVE-2018-1672 287 2018-10-01 2018-11-21
6.5
None Remote Low Single system Partial Partial Partial
IBM WebSphere Portal 7.0, 8.0, 8.5, and 9.0 may fail to set the correct user context in certain impersonation scenarios, which can allow a user to act with the identity of a different user. IBM X-Force ID: 144958.
2682 CVE-2018-1661 352 CSRF 2018-12-20 2019-01-04
6.8
None Remote Medium Not required Partial Partial Partial
IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, and 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144887.
2683 CVE-2018-1638 287 2018-07-31 2018-09-28
6.8
None Remote Medium Not required Partial Partial Partial
IBM API Connect 5.0.0.0-5.0.8.3 Developer Portal does not enforce Two Factor Authentication (TFA) while resetting a user password but enforces it for all other login scenarios. IBM X-Force ID: 144483.
2684 CVE-2018-1622 352 CSRF 2019-04-02 2019-04-02
6.8
None Remote Medium Not required Partial Partial Partial
IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 144348.
2685 CVE-2018-1595 77 Exec Code 2018-08-01 2018-10-04
6.5
None Remote Low Single system Partial Partial Partial
IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622.
2686 CVE-2018-1551 284 2018-08-06 2018-10-05
6.0
None Remote Medium Single system Partial Partial Partial
IBM WebSphere MQ 8.0.0.2 through 8.0.0.8 and 9.0.0.0 through 9.0.0.3 could allow users to have more authority than they should have if an MQ administrator creates an invalid user group name. IBM X-Force ID: 142888.
2687 CVE-2018-1539 287 Bypass 2018-09-25 2018-11-23
6.4
None Remote Low Not required Partial Partial None
IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.
2688 CVE-2018-1514 352 CSRF 2018-06-07 2018-07-16
6.8
None Remote Medium Not required Partial Partial Partial
IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622.
2689 CVE-2018-1479 352 CSRF 2018-04-27 2018-05-25
6.8
None Remote Medium Not required Partial Partial Partial
IBM BigFix Platform 9.2 and 9.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 140761.
2690 CVE-2018-1462 284 DoS 2018-05-17 2018-06-15
6.5
None Remote Low Single system Partial Partial Partial
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to access system files they should not have access to including deleting files or causing a denial of service. IBM X-Force ID: 140363.
2691 CVE-2018-1458 426 Exec Code 2018-07-10 2018-09-06
6.8
None Remote Medium Not required Partial Partial Partial
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks. IBM X-Force ID: 140209.
2692 CVE-2018-1455 352 CSRF 2018-08-15 2018-10-16
6.8
None Remote Medium Not required Partial Partial Partial
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 11029.
2693 CVE-2018-1453 434 2018-06-08 2018-07-27
6.5
None Remote Low Single system Partial Partial Partial
IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the environment. IBM X-Force ID: 140055.
2694 CVE-2018-1442 352 CSRF 2018-03-08 2018-03-27
6.8
None Remote Medium Not required Partial Partial Partial
IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139598.
2695 CVE-2018-1437 426 Exec Code 2018-03-13 2018-04-07
6.8
None Remote Medium Not required Partial Partial Partial
IBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by an error related to multiple untrusted search path. A local attacker could exploit this vulnerability to DLL hijacking to execute arbitrary code on the system or cause the application to crash. IBM X-Force ID: 139565.
2696 CVE-2018-1435 426 Exec Code 2018-03-13 2018-04-07
6.8
None Remote Medium Not required Partial Partial Partial
IBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a user to double click a malicious executable in an attacker-controlled directory, which could result in code execution. IBM X-Force ID: 139563.
2697 CVE-2018-1434 352 CSRF 2018-05-17 2018-06-15
6.8
None Remote Medium Not required Partial Partial Partial
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474.
2698 CVE-2018-1426 320 2018-03-22 2018-12-20
6.4
None Remote Low Not required Partial Partial None
IBM GSKit (IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1) duplicates the PRNG state across fork() system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071.
2699 CVE-2018-1417 264 2018-02-22 2018-05-16
6.8
None Remote Medium Not required Partial Partial Partial
Under certain circumstances, a flaw in the J9 JVM (IBM SDK, Java Technology Edition 7.1 and 8.0) allows untrusted code running under a security manager to elevate its privileges. IBM X-Force ID: 138823.
2700 CVE-2018-1414 89 Sql 2018-02-22 2018-03-09
6.5
None Remote Low Single system Partial Partial Partial
IBM Maximo Asset Management 7.5 and 7.6 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 138820.
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.