[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1899 mean in the context of cybersecurity?

[Assistant] CVE-2018-1899


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1899.

[Assistant] IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an attacker to change one of the settings related to InfoSphere Business Glossary Anywhere due to improper access control. IBM X-Force ID: 152528.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1899?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1899?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1900 mean in the context of cybersecurity?

[Assistant] CVE-2018-1900


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1900.

[Assistant] IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1900?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1900?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1901 mean in the context of cybersecurity?

[Assistant] CVE-2018-1901


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1901.

[Assistant] IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by incorrect cached value being used. IBM X-Force ID: 152530.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1901?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1901?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1902 mean in the context of cybersecurity?

[Assistant] CVE-2018-1902


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1902.

[Assistant] IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to spoof connection information which could be used to launch further attacks against the system. IBM X-Force ID: 152531.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1902?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1902?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1903 mean in the context of cybersecurity?

[Assistant] CVE-2018-1903


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1903.

[Assistant] IBM Sterling Connect:Direct for UNIX 4.2.0, 4.3.0, and 6.0.0 could allow a user with restricted sudo access on a system to manipulate CD UNIX to gain full sudo access. IBM X-Force ID: 152532.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1903?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1903?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1904 mean in the context of cybersecurity?

[Assistant] CVE-2018-1904


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1904.

[Assistant] IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow remote attackers to execute arbitrary Java code through an administrative client class with a serialized object from untrusted sources. IBM X-Force ID: 152533.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1904?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1904?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1905 mean in the context of cybersecurity?

[Assistant] CVE-2018-1905


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1905.

[Assistant] IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1905?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1905?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1906 mean in the context of cybersecurity?

[Assistant] CVE-2018-1906


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1906.

[Assistant] IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP request. IBM X-Force ID: 152663.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1906?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1906?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1908 mean in the context of cybersecurity?

[Assistant] CVE-2018-1908


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1908.

[Assistant] IBM Robotic Process Automation with Automation Anywhere 11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152671.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1908?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1908?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1910 mean in the context of cybersecurity?

[Assistant] CVE-2018-1910


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1910.

[Assistant] IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152734.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1910?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1910?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1911 mean in the context of cybersecurity?

[Assistant] CVE-2018-1911


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1911.

[Assistant] IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.2 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152735.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1911?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1911?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1912 mean in the context of cybersecurity?

[Assistant] CVE-2018-1912


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1912.

[Assistant] IBM DOORS Next Generation (DNG/RRC) 6.0.2 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152736.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1912?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1912?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1913 mean in the context of cybersecurity?

[Assistant] CVE-2018-1913


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1913.

[Assistant] IBM DOORS Next Generation (DNG/RRC) 5.0 through 5.0.3 and 6.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152737.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1913?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1913?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1914 mean in the context of cybersecurity?

[Assistant] CVE-2018-1914


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1914.

[Assistant] IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152738.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1914?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1914?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1916 mean in the context of cybersecurity?

[Assistant] CVE-2018-1916


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1916.

[Assistant] IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152740.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1916?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1916?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1917 mean in the context of cybersecurity?

[Assistant] CVE-2018-1917


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1917.

[Assistant] IBM InfoSphere Information Server 11.3, 11.5, and 11.7 could allow an authenticated user to access JSP files and disclose sensitive information. IBM X-Force ID: 152784.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1917?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1917?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1918 mean in the context of cybersecurity?

[Assistant] CVE-2018-1918


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1918.

[Assistant] IBM Jazz Reporting Service (JRS) 6.0.3, 6.0.4, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152785.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1918?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1918?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1920 mean in the context of cybersecurity?

[Assistant] CVE-2018-1920


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1920.

[Assistant] IBM Marketing Platform 9.1.0, 9.1.2 and 10.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152855.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1920?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1920?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1921 mean in the context of cybersecurity?

[Assistant] CVE-2018-1921


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1921.

[Assistant] IBM Campaign 9.1.0, 9.1.2, 10.1, and 11.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152857.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1921?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1921?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1922 mean in the context of cybersecurity?

[Assistant] CVE-2018-1922


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1922.

[Assistant] IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152858.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1922?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1922?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1923 mean in the context of cybersecurity?

[Assistant] CVE-2018-1923


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1923.

[Assistant] IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 152859.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1923?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1923?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1925 mean in the context of cybersecurity?

[Assistant] CVE-2018-1925


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1925.

[Assistant] IBM WebShere MQ 9.1.0.0, 9.1.0.1, 9.1.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 152925.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1925?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1925?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1926 mean in the context of cybersecurity?

[Assistant] CVE-2018-1926


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1926.

[Assistant] IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Admin Console is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading a user to visit a malicious URL, a remote attacker could send a specially-crafted request. An attacker could exploit this vulnerability to perform CSRF attack and update available applications. IBM X-Force ID: 152992.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1926?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1926?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1927 mean in the context of cybersecurity?

[Assistant] CVE-2018-1927


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1927.

[Assistant] IBM StoredIQ 7.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153118.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1927?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1927?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1928 mean in the context of cybersecurity?

[Assistant] CVE-2018-1928


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1928.

[Assistant] IBM StoredIQ 7.6.0 does not implement proper authorization of user roles due to which it was possible for a low privileged user to access the application endpoints of high privileged users and also perform some state changing actions restricted to a high privileged user. IBM X-Force ID: 153119.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1928?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1928?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1929 mean in the context of cybersecurity?

[Assistant] CVE-2018-1929


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1929.

[Assistant] IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1929?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1929?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1932 mean in the context of cybersecurity?

[Assistant] CVE-2018-1932


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1932.

[Assistant] IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could allow an authenticated user to obtain highly sensitive information. IBM X-Force ID: 153175.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1932?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1932?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1933 mean in the context of cybersecurity?

[Assistant] CVE-2018-1933


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1933.

[Assistant] IBM Planning Analytics 2.0 through 2.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153177.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1933?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1933?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1934 mean in the context of cybersecurity?

[Assistant] CVE-2018-1934


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1934.

[Assistant] IBM Cognos Business Intelligence 10.2.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 153179.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1934?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1934?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1935 mean in the context of cybersecurity?

[Assistant] CVE-2018-1935


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1935.

[Assistant] IBM Connections 5.0, 5.5, and 6.0 could allow an authenticated user to obtain sensitive information from invalid request error messages. IBM X-Force ID: 153315.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1935?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1935?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1936 mean in the context of cybersecurity?

[Assistant] CVE-2018-1936


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1936.

[Assistant] IBM DB2 9.7, 10.1, 10.5, and 11.1 libdb2e.so.1 is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 153316.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1936?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1936?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1937 mean in the context of cybersecurity?

[Assistant] CVE-2018-1937


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1937.

[Assistant] IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153317.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1937?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1937?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1938 mean in the context of cybersecurity?

[Assistant] CVE-2018-1938


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1938.

[Assistant] IBM Cloud Private 3.1.1 could alllow a local user with administrator privileges to intercept highly sensitive unencrypted data. IBM X-Force ID: 153318.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1938?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1938?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1939 mean in the context of cybersecurity?

[Assistant] CVE-2018-1939


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1939.

[Assistant] IBM Cloud Private 3.1.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 153319.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1939?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1939?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1941 mean in the context of cybersecurity?

[Assistant] CVE-2018-1941


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1941.

[Assistant] IBM Campaign 9.1.0 and 9.1.2 could allow a local user to obtain admini privileges due to the application not validating access permissions. IBM X-Force ID: 153382.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1941?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1941?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1943 mean in the context of cybersecurity?

[Assistant] CVE-2018-1943


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1943.

[Assistant] IBM Cloud Private 3.1.0 and 3.1.1 is vulnerable to HTTP HOST header injection, caused by improper validation of input. By persuading a victim to visit a specially-crafted Web page, a remote attacker could exploit this vulnerability to inject arbitrary HTTP headers, which will allow the attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 153385.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1943?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1943?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1944 mean in the context of cybersecurity?

[Assistant] CVE-2018-1944


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1944.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1944?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1944?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1945 mean in the context of cybersecurity?

[Assistant] CVE-2018-1945


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1945.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1945?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1945?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1946 mean in the context of cybersecurity?

[Assistant] CVE-2018-1946


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1946.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1946?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1946?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1947 mean in the context of cybersecurity?

[Assistant] CVE-2018-1947


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1947.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1947?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1947?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1948 mean in the context of cybersecurity?

[Assistant] CVE-2018-1948


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1948.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1948?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1948?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1949 mean in the context of cybersecurity?

[Assistant] CVE-2018-1949


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1949.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1949?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1949?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1950 mean in the context of cybersecurity?

[Assistant] CVE-2018-1950


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1950.

[Assistant] IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1950?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1950?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1951 mean in the context of cybersecurity?

[Assistant] CVE-2018-1951


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1951.

[Assistant] IBM Publishing Engine 2.1.2, 6.0.5, and 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153494.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1951?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1951?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1952 mean in the context of cybersecurity?

[Assistant] CVE-2018-1952


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1952.

[Assistant] IBM Jazz Foundation (IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153495.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1952?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1952?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1956 mean in the context of cybersecurity?

[Assistant] CVE-2018-1956


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1956.

[Assistant] IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1956?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1956?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1957 mean in the context of cybersecurity?

[Assistant] CVE-2018-1957


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1957.

[Assistant] IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based on an incorrect return by the httpServletRequest#authenticate() API when an unprotected URI is accessed. IBM X-Force ID: 153629.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1957?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1957?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1959 mean in the context of cybersecurity?

[Assistant] CVE-2018-1959


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1959.

[Assistant] IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153633.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1959?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1959?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1961 mean in the context of cybersecurity?

[Assistant] CVE-2018-1961


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1961.

[Assistant] IBM Emptoris Contract Management 10.0.0 and 10.1.3.0 could disclose sensitive information from detailed information from error messages. IBM X-Force ID: 153657.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1961?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1961?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1962 mean in the context of cybersecurity?

[Assistant] CVE-2018-1962


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1962.

[Assistant] IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1962?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1962?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1967 mean in the context of cybersecurity?

[Assistant] CVE-2018-1967


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1967.

[Assistant] IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153748.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1967?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1967?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1968 mean in the context of cybersecurity?

[Assistant] CVE-2018-1968


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1968.

[Assistant] IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1968?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1968?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1969 mean in the context of cybersecurity?

[Assistant] CVE-2018-1969


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1969.

[Assistant] IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 153750.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1969?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1969?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1970 mean in the context of cybersecurity?

[Assistant] CVE-2018-1970


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1970.

[Assistant] IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1970?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1970?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1973 mean in the context of cybersecurity?

[Assistant] CVE-2018-1973


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1973.

[Assistant] IBM API Connect 5.0.0.0 through 5.0.8.4 allows a user with limited 'API Administrator level access to give themselves full 'Administrator' level access through the members functionality. IBM X-Force ID: 153914.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1973?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1973?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1974 mean in the context of cybersecurity?

[Assistant] CVE-2018-1974


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1974.

[Assistant] IBM WebSphere 8.0.0.0 through 9.1.1 could allow an authenticated attacker to escalate their privileges when using multiplexed channels. IBM X-Force ID: 153915.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1974?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1974?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1975 mean in the context of cybersecurity?

[Assistant] CVE-2018-1975


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1975.

[Assistant] IBM Rational DOORS Web Access 9.5.1 through 9.5.2.9, and 9.6 through 9.6.1.9 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153916.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1975?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1975?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1976 mean in the context of cybersecurity?

[Assistant] CVE-2018-1976


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1976.

[Assistant] IBM API Connect 5.0.0.0 through 5.0.8.4 is impacted by sensitive information disclosure via a REST API that could allow a user with administrative privileges to obtain highly sensitive information. IBM X-Force ID: 154031.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1976?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1976?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1977 mean in the context of cybersecurity?

[Assistant] CVE-2018-1977


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1977.

[Assistant] IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1977?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1977?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1978 mean in the context of cybersecurity?

[Assistant] CVE-2018-1978


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1978.

[Assistant] IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154069.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1978?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1978?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1980 mean in the context of cybersecurity?

[Assistant] CVE-2018-1980


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1980.

[Assistant] IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1980?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1980?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1982 mean in the context of cybersecurity?

[Assistant] CVE-2018-1982


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1982.

[Assistant] IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154135.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1982?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1982?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1983 mean in the context of cybersecurity?

[Assistant] CVE-2018-1983


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1983.

[Assistant] IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154136.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1983?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1983?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1984 mean in the context of cybersecurity?

[Assistant] CVE-2018-1984


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1984.

[Assistant] IBM Rational Team Concert 5.0 through 6.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 154137.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1984?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1984?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1985 mean in the context of cybersecurity?

[Assistant] CVE-2018-1985


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1985.

[Assistant] IBM Trusteer Rapport/Apex 3.6.1908.22 contains an unused legacy driver which could allow a user with administrator privileges to cause a buffer overflow that would result in a kernel panic. IBM X-Force ID: 154207.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1985?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1985?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1987 mean in the context of cybersecurity?

[Assistant] CVE-2018-1987


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1987.

[Assistant] IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace file. IBM X-Force ID: 154280.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1987?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1987?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1990 mean in the context of cybersecurity?

[Assistant] CVE-2018-1990


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1990.

[Assistant] IBM Cloud App Management V2018.2.0, V2018.4.0, and V2018.4.1 could allow an attacker to obtain sensitive configuration information using a specially crafted HTTP request. IBM X-Force ID: 154283.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1990?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1990?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1991 mean in the context of cybersecurity?

[Assistant] CVE-2018-1991


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1991.

[Assistant] IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1991?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1991?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1992 mean in the context of cybersecurity?

[Assistant] CVE-2018-1992


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1992.

[Assistant] The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image that drives the rest of the system's hardware initialization. The bootloader firmware contains a buffer overflow vulnerability such that, if an attacker were able to replace the initial boot firmware image with a very carefully crafted and sufficiently large, malicious replacement, it could cause the bootloader, during the load of that image, to overwrite its own instruction memory and circumvent secure boot protections, install trojans, etc. IBM X-Force ID: 154345.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1992?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1992?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1993 mean in the context of cybersecurity?

[Assistant] CVE-2018-1993


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1993.

[Assistant] IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1993?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1993?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1994 mean in the context of cybersecurity?

[Assistant] CVE-2018-1994


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1994.

[Assistant] IBM InfoSphere Information Server 11.5 and 11.7 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 154494.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1994?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1994?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1996 mean in the context of cybersecurity?

[Assistant] CVE-2018-1996


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1996.

[Assistant] IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could provide weaker than expected security, caused by the improper TLS configuration. A remote attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 154650.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1996?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1996?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1997 mean in the context of cybersecurity?

[Assistant] CVE-2018-1997


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1997.

[Assistant] IBM Business Automation Workflow and Business Process Manager 18.0.0.0, 18.0.0.1, and 18.0.0.2 are vulnerable to a denial of service attack. An authenticated attacker might send a specially crafted request that exhausts server-side memory. IBM X-Force ID: 154774.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1997?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1997?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1998 mean in the context of cybersecurity?

[Assistant] CVE-2018-1998


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1998.

[Assistant] IBM WebSphere MQ 8.0.0.0 through 9.1.1 could allow a local user to inject code that could be executed with root privileges. This is due to an incomplete fix for CVE-2018-1792. IBM X-ForceID: 154887.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1998?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1998?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2018-1999 mean in the context of cybersecurity?

[Assistant] CVE-2018-1999


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2018-1999.

[Assistant] IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, and 18.0.0.2 could reveal sensitive version information about the server from error pages that could aid an attacker in further attacks against the system. IBM X-Force ID: 154889.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2018-1999?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2018-1999?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0001 mean in the context of cybersecurity?

[Assistant] CVE-2019-0001


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0001.

[Assistant] Receipt of a malformed packet on MX Series devices with dynamic vlan configuration can trigger an uncontrolled recursion loop in the Broadband Edge subscriber management daemon (bbe-smgd), and lead to high CPU usage and a crash of the bbe-smgd service. Repeated receipt of the same packet can result in an extended denial of service condition for the device. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S1; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0001?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0001?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0002 mean in the context of cybersecurity?

[Assistant] CVE-2019-0002


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0002.

[Assistant] On EX2300 and EX3400 series, stateless firewall filter configuration that uses the action 'policer' in combination with other actions might not take effect. When this issue occurs, the output of the command: show pfe filter hw summary will not show the entry for: RACL group Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2. This issue affect both IPv4 and IPv6 firewall filter.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0002?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0002?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0003 mean in the context of cybersecurity?

[Assistant] CVE-2019-0003


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0003.

[Assistant] When a specific BGP flowspec configuration is enabled and upon receipt of a specific matching BGP packet meeting a specific term in the flowspec configuration, a reachable assertion failure occurs, causing the routing protocol daemon (rpd) process to crash with a core file being generated. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on EX2200/VC, EX3200, EX3300/VC, EX4200, EX4300, EX4550/VC, EX4600, EX6200, EX8200/VC (XRE), QFX3500, QFX3600, QFX5100; 15.1 versions prior to 15.1R3; 15.1F versions prior to 15.1F3; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0003?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0003?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0004 mean in the context of cybersecurity?

[Assistant] CVE-2019-0004


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0004.

[Assistant] On Juniper ATP, the API key and the device key are logged in a file readable by authenticated local users. These keys are used for performing critical operations on the WebUI interface. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0004?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0004?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0005 mean in the context of cybersecurity?

[Assistant] CVE-2019-0005


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0005.

[Assistant] On EX2300, EX3400, EX4600, QFX3K and QFX5K series, firewall filter configuration cannot perform packet matching on any IPv6 extension headers. This issue may allow IPv6 packets that should have been blocked to be forwarded. IPv4 packet filtering is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS on EX and QFX series;: 14.1X53 versions prior to 14.1X53-D47; 15.1 versions prior to 15.1R7; 15.1X53 versions prior to 15.1X53-D234 on QFX5200/QFX5110 series; 15.1X53 versions prior to 15.1X53-D591 on EX2300/EX3400 series; 16.1 versions prior to 16.1R7; 17.1 versions prior to 17.1R2-S10, 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0005?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0005?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0006 mean in the context of cybersecurity?

[Assistant] CVE-2019-0006


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0006.

[Assistant] A certain crafted HTTP packet can trigger an uninitialized function pointer deference vulnerability in the Packet Forwarding Engine manager (fxpc) on all EX, QFX and MX Series devices in a Virtual Chassis configuration. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. This issue only occurs when the crafted packet it destined to the device. Affected releases are Juniper Networks Junos OS: 14.1X53 versions prior to 14.1X53-D47 on EX and QFX Virtual Chassis Platforms; 15.1 versions prior to 15.1R7-S3 all Virtual Chassis Platforms 15.1X53 versions prior to 15.1X53-D50 on EX and QFX Virtual Chassis Platforms.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0006?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0006?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0007 mean in the context of cybersecurity?

[Assistant] CVE-2019-0007


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0007.

[Assistant] The vMX Series software uses a predictable IP ID Sequence Number. This leaves the system as well as clients connecting through the device susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack. This issue was found during internal product security testing. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5 on vMX Series.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0007?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0007?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0008 mean in the context of cybersecurity?

[Assistant] CVE-2019-0008


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0008.

[Assistant] A certain sequence of valid BGP or IPv6 BFD packets may trigger a stack based buffer overflow in the Junos OS Packet Forwarding Engine manager (FXPC) process on QFX5000 series, EX4300, EX4600 devices. This issue can result in a crash of the fxpc daemon or may potentially lead to remote code execution. Affected releases are Juniper Networks Junos OS on QFX 5000 series, EX4300, EX4600 are: 14.1X53; 15.1X53 versions prior to 15.1X53-D235; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3; 17.3 versions prior to 17.3R3-S2, 17.3R4; 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1, 18.1R4; 18.2 versions prior to 18.2R2; 18.2X75 versions prior to 18.2X75-D30; 18.3 versions prior to 18.3R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0008?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0008?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0009 mean in the context of cybersecurity?

[Assistant] CVE-2019-0009


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0009.

[Assistant] On EX2300 and EX3400 series, high disk I/O operations may disrupt the communication between the routing engine (RE) and the packet forwarding engine (PFE). In a virtual chassis (VC) deployment, this issue disrupts communication between the VC members. This issue does not affect other Junos platforms. Affected releases are Junos OS on EX2300 and EX3400 series: 15.1X53 versions prior to 15.1X53-D590; 18.1 versions prior to 18.1R2-S2, 18.1R3; 18.2 versions prior to 18.2R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0009?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0009?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0010 mean in the context of cybersecurity?

[Assistant] CVE-2019-0010


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0010.

[Assistant] An SRX Series Service Gateway configured for Unified Threat Management (UTM) may experience a system crash with the error message "mbuf exceed" -- an indication of memory buffer exhaustion -- due to the receipt of crafted HTTP traffic. Each crafted HTTP packet inspected by UTM consumes mbufs which can be identified through the following log messages: all_logs.0:Jun 8 03:25:03 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 50%. all_logs.0:Jun 8 03:25:13 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 51%. all_logs.0:Jun 8 03:25:24 srx1 node0.fpc4 : SPU3 jmpi mbuf stall 52%. ... Eventually the system runs out of mbufs and the system crashes (fails over) with the error "mbuf exceed". This issue only occurs when HTTP AV inspection is configured. Devices configured for Web Filtering alone are unaffected by this issue. Affected releases are Junos OS on SRX Series: 12.1X46 versions prior to 12.1X46-D81; 12.3X48 versions prior to 12.3X48-D77; 15.1X49 versions prior to 15.1X49-D101, 15.1X49-D110.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0010?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0010?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0011 mean in the context of cybersecurity?

[Assistant] CVE-2019-0011


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0011.

[Assistant] The Junos OS kernel crashes after processing a specific incoming packet to the out of band management interface (such as fxp0, me0, em0, vme0) destined for another address. By continuously sending this type of packet, an attacker can repeatedly crash the kernel causing a sustained Denial of Service. Affected releases are Juniper Networks Junos OS: 17.2 versions prior to 17.2R1-S7, 17.2R3; 17.3 versions prior to 17.3R3-S3; 17.4 versions prior to 17.4R1-S4, 17.4R2; 17.2X75 versions prior to 17.2X75-D110; 18.1 versions prior to 18.1R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0011?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0011?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0012 mean in the context of cybersecurity?

[Assistant] CVE-2019-0012


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0012.

[Assistant] A Denial of Service (DoS) vulnerability in BGP in Juniper Networks Junos OS configured as a VPLS PE allows an attacker to craft a specific BGP message to cause the routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. This issue only affects PE routers configured with BGP Auto discovery for LDP VPLS. Other BGP configurations are unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D81; 12.3 versions prior to 12.3R12-S12; 12.3X48 versions prior to 12.3X48-D76; 14.1X53 versions prior to 14.1X53-D48; 15.1 versions prior to 15.1F6-S12, 15.1R7-S2; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D235, 15.1X53-D495, 15.1X53-D590, 15.1X53-D68; 16.1 versions prior to 16.1R3-S10, 16.1R4-S12, 16.1R6-S6, 16.1R7-S1; 16.2 versions prior to 16.2R2-S7; 17.1 versions prior to 17.1R2-S9, 17.1R3; 17.2 versions prior to 17.2R1-S7, 17.2R2-S6, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R1-S5, 17.4R2; 18.1 versions prior to 18.1R2-S3, 18.1R3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0012?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0012?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0013 mean in the context of cybersecurity?

[Assistant] CVE-2019-0013


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0013.

[Assistant] The routing protocol daemon (RPD) process will crash and restart when a specific invalid IPv4 PIM Join packet is received. While RPD restarts after a crash, repeated crashes can result in an extended Denial of Service (DoS) condition. This issue only affects IPv4 PIM. IPv6 PIM is unaffected by this vulnerability. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77; 12.3X48 versions prior to 12.3X48-D77; 15.1 versions prior to 15.1F6-S10, 15.1R6-S6, 15.1R7; 15.1X49 versions prior to 15.1X49-D150; 15.1X53 versions prior to 15.1X53-D233, 15.1X53-D59; 16.1 versions prior to 16.1R3-S8, 16.1R4-S8, 16.1R7; 16.2 versions prior to 16.2R2-S6; 17.1 versions prior to 17.1R2-S6, 17.1R3; 17.2 versions prior to 17.2R2-S3, 17.2R3; 17.3 versions prior to 17.3R2-S4, 17.3R3; 17.4 versions prior to 17.4R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0013?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0013?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0014 mean in the context of cybersecurity?

[Assistant] CVE-2019-0014


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0014.

[Assistant] On QFX and PTX Series, receipt of a malformed packet for J-Flow sampling might crash the FPC (Flexible PIC Concentrator) process which causes all interfaces to go down. By continuously sending the offending packet, an attacker can repeatedly crash the FPC process causing a sustained Denial of Service (DoS). This issue affects both IPv4 and IPv6 packet processing. Affected releases are Juniper Networks Junos OS on QFX and PTX Series: 17.4 versions prior to 17.4R2-S1, 17.4R3; 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R1-S3, 18.2R2; 17.2X75 versions prior to 17.2X75-D91, 17.2X75-D100.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0014?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0014?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0015 mean in the context of cybersecurity?

[Assistant] CVE-2019-0015


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0015.

[Assistant] A vulnerability in the SRX Series Service Gateway allows deleted dynamic VPN users to establish dynamic VPN connections until the device is rebooted. A deleted dynamic VPN connection should be immediately disallowed from establishing new VPN connections. Due to an error in token caching, deleted users are allowed to connect once a previously successful dynamic VPN connection has been established. A reboot is required to clear the cached authentication token. Affected releases are Junos OS on SRX Series: 12.3X48 versions prior to 12.3X48-D75; 15.1X49 versions prior to 15.1X49-D150; 17.3 versions prior to 17.3R3; 17.4 versions prior to 17.4R2; 18.1 versions prior to 18.1R3; 18.2 versions prior to 18.2R2.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0015?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0015?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0016 mean in the context of cybersecurity?

[Assistant] CVE-2019-0016


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0016.

[Assistant] A malicious authenticated user may be able to delete a device from the Junos Space database without the necessary privileges through crafted Ajax interactions obtained from another legitimate delete action performed by another administrative user. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0016?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0016?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0017 mean in the context of cybersecurity?

[Assistant] CVE-2019-0017


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0017.

[Assistant] The Junos Space application, which allows Device Image files to be uploaded, has insufficient validity checking which may allow uploading of malicious images or scripts, or other content types. Affected releases are Juniper Networks Junos Space versions prior to 18.3R1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0017?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0017?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0018 mean in the context of cybersecurity?

[Assistant] CVE-2019-0018


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0018.

[Assistant] A persistent cross-site scripting (XSS) vulnerability in the file upload menu of Juniper ATP may allow an authenticated user to inject arbitrary scripts and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0018?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0018?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0019 mean in the context of cybersecurity?

[Assistant] CVE-2019-0019


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0019.

[Assistant] When BGP tracing is enabled an incoming BGP message may cause the Junos OS routing protocol daemon (rpd) process to crash and restart. While rpd restarts after a crash, repeated crashes can result in an extended DoS condition. Affected releases are Juniper Networks Junos OS: 16.1 versions prior to 16.1R7-S4, 16.1R7-S5; 16.2 versions prior to 16.2R2-S9, 16.2R3; 17.1 versions prior to 17.1R3; 17.2 versions prior to 17.2R3-S1; 17.3 versions prior to 17.3R3-S3, 17.3R3-S4, 17.3R4; 17.4 versions prior to 17.4R1-S7, 17.4R2-S3, 17.4R2-S4, 17.4R3; 18.1 versions prior to 18.1R2-S4, 18.1R3-S4, 18.1R4; 18.2 versions prior to 18.2R2-S2, 18.2R2-S3, 18.2R3; 18.2X75 versions prior to 18.2X75-D40; 18.3 versions prior to 18.3R1-S3, 18.3R2; 18.4 versions prior to 18.4R1-S2, 18.4R2. This issue does not affect Junos releases prior to 16.1R1.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0019?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0019?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0020 mean in the context of cybersecurity?

[Assistant] CVE-2019-0020


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0020.

[Assistant] Juniper ATP ships with hard coded credentials in the Web Collector instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0020?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0020?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0021 mean in the context of cybersecurity?

[Assistant] CVE-2019-0021


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0021.

[Assistant] On Juniper ATP, secret passphrase CLI inputs, such as "set mcm", are logged to /var/log/syslog in clear text, allowing authenticated local user to be able to view these secret information. This issue affects Juniper ATP 5.0 versions prior to 5.0.4.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0021?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0021?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0022 mean in the context of cybersecurity?

[Assistant] CVE-2019-0022


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0022.

[Assistant] Juniper ATP ships with hard coded credentials in the Cyphort Core instance which gives an attacker the ability to take full control of any installation of the software. Affected releases are Juniper Networks Juniper ATP: 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0022?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0022?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0023 mean in the context of cybersecurity?

[Assistant] CVE-2019-0023


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0023.

[Assistant] A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0023?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0023?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0024 mean in the context of cybersecurity?

[Assistant] CVE-2019-0024


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0024.

[Assistant] A persistent cross-site scripting (XSS) vulnerability in the Email Collectors menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0024?


[System] CVE Vulnerability Information

[User] Explain the state of this CVE: What is the publication or resolution state of CVE-2019-0024?

[Assistant] PUBLISHED


[System] CVE Vulnerability Information

[User] Explain the CVE ID: What does the identifier CVE-2019-0025 mean in the context of cybersecurity?

[Assistant] CVE-2019-0025


[System] CVE Vulnerability Information

[User] Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2019-0025.

[Assistant] A persistent cross-site scripting (XSS) vulnerability in RADIUS configuration menu of Juniper ATP may allow authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.


[System] CVE Vulnerability Information

[User] Provide references for further information: Can you share references or external links related to CVE-2019-0025?