mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-06-08 05:58:08 +00:00
IBM20200729-10141
Added CVE-2020-4569, CVE-2020-4644, CVE-2020-4573, CVE-2020-4463, CVE-2020-4567, CVE-2020-4574, CVE-2020-4645, CVE-2020-4572
This commit is contained in:
Scott Moore - IBM
parent
1dc119ec7f
commit
24816621d5
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4463",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "U"
|
||||
},
|
||||
"BM" : {
|
||||
"S" : "U",
|
||||
"PR" : "N",
|
||||
"UI" : "N",
|
||||
"SCORE" : "8.200",
|
||||
"AV" : "N",
|
||||
"I" : "N",
|
||||
"C" : "H",
|
||||
"AC" : "L",
|
||||
"A" : "L"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"STATE" : "PUBLIC",
|
||||
"ID" : "CVE-2020-4463",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00",
|
||||
"ASSIGNER" : "psirt@us.ibm.com"
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Maximo Asset Management",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "7.6.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "7.6.0.2"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253953",
|
||||
"refsource" : "CONFIRM",
|
||||
"title" : "IBM Security Bulletin 6253953 (Maximo Asset Management)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253953"
|
||||
},
|
||||
{
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-maximo-cve20204463-xxe (181484)",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/181484"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Obtain Information",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"value" : "IBM Maximo Asset Management 7.6.0.1 and 7.6.0.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181484.",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4567",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_format" : "MITRE",
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00",
|
||||
"ID" : "CVE-2020-4567",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"BM" : {
|
||||
"SCORE" : "8.600",
|
||||
"UI" : "N",
|
||||
"PR" : "N",
|
||||
"S" : "C",
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"C" : "H",
|
||||
"AV" : "N",
|
||||
"I" : "N"
|
||||
},
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "U"
|
||||
}
|
||||
}
|
||||
},
|
||||
"data_version" : "4.0",
|
||||
"data_type" : "CVE",
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Obtain Information"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"title" : "IBM Security Bulletin 6253781 (Security Key Lifecycle Manager)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253781"
|
||||
},
|
||||
{
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/184156",
|
||||
"name" : "ibm-tivoli-cve20204567-info-disc (184156)",
|
||||
"refsource" : "XF"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 184156."
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "3.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "4.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name" : "Security Key Lifecycle Manager"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4569",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Bypass Security"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"refsource" : "CONFIRM",
|
||||
"title" : "IBM Security Bulletin 6253781 (Security Key Lifecycle Manager)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253781"
|
||||
},
|
||||
{
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-tivoli-cve20204569-sec-bypass (184158)",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/184158"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"value" : "IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism. IBM X-Force ID: 184158.",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Security Key Lifecycle Manager",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "3.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "4.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"BM" : {
|
||||
"S" : "U",
|
||||
"UI" : "N",
|
||||
"PR" : "N",
|
||||
"SCORE" : "6.500",
|
||||
"AV" : "N",
|
||||
"I" : "L",
|
||||
"C" : "L",
|
||||
"AC" : "L",
|
||||
"A" : "N"
|
||||
},
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "U"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"STATE" : "PUBLIC",
|
||||
"ID" : "CVE-2020-4569",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00"
|
||||
},
|
||||
"data_version" : "4.0",
|
||||
"data_type" : "CVE"
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4572",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 184179."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Obtain Information"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"title" : "IBM Security Bulletin 6253781 (Security Key Lifecycle Manager)",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"refsource" : "CONFIRM"
|
||||
},
|
||||
{
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-tivoli-cve20204572-info-disc (184179)",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/184179"
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Security Key Lifecycle Manager",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "3.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "4.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RC" : "C",
|
||||
"RL" : "O",
|
||||
"E" : "U"
|
||||
},
|
||||
"BM" : {
|
||||
"AC" : "L",
|
||||
"A" : "N",
|
||||
"AV" : "N",
|
||||
"I" : "N",
|
||||
"C" : "L",
|
||||
"PR" : "N",
|
||||
"UI" : "N",
|
||||
"SCORE" : "5.300",
|
||||
"S" : "U"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"ID" : "CVE-2020-4572",
|
||||
"STATE" : "PUBLIC",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00",
|
||||
"ASSIGNER" : "psirt@us.ibm.com"
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0"
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4573",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"data_version" : "4.0",
|
||||
"data_type" : "CVE",
|
||||
"data_format" : "MITRE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"E" : "U",
|
||||
"RL" : "O",
|
||||
"RC" : "C"
|
||||
},
|
||||
"BM" : {
|
||||
"C" : "L",
|
||||
"I" : "N",
|
||||
"AV" : "N",
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"S" : "U",
|
||||
"SCORE" : "5.300",
|
||||
"UI" : "N",
|
||||
"PR" : "N"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"STATE" : "PUBLIC",
|
||||
"ID" : "CVE-2020-4573"
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "3.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "4.0"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name" : "Security Key Lifecycle Manager"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"value" : "IBM Tivoli Key Lifecycle Manager 3.0.1 and 4.0 could disclose sensitive information due to responding to unauthenticated HTTP requests. IBM X-Force ID: 184180.",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Obtain Information",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"refsource" : "CONFIRM",
|
||||
"title" : "IBM Security Bulletin 6253781 (Security Key Lifecycle Manager)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253781"
|
||||
},
|
||||
{
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/184180",
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-tivoli-cve20204573-info-disc (184180)"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4574",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 184181."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"value" : "Obtain Information",
|
||||
"lang" : "eng"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"title" : "IBM Security Bulletin 6253781 (Security Key Lifecycle Manager)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253781",
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253781"
|
||||
},
|
||||
{
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/184181",
|
||||
"name" : "ibm-tivoli-cve20204574-info-disc (184181)",
|
||||
"refsource" : "XF"
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Security Key Lifecycle Manager",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "3.0.1"
|
||||
},
|
||||
{
|
||||
"version_value" : "4.0"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"CVE_data_meta" : {
|
||||
"ID" : "CVE-2020-4574",
|
||||
"STATE" : "PUBLIC",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00"
|
||||
},
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RC" : "C",
|
||||
"RL" : "O",
|
||||
"E" : "U"
|
||||
},
|
||||
"BM" : {
|
||||
"S" : "C",
|
||||
"UI" : "R",
|
||||
"PR" : "N",
|
||||
"SCORE" : "7.400",
|
||||
"AV" : "N",
|
||||
"I" : "N",
|
||||
"C" : "H",
|
||||
"AC" : "L",
|
||||
"A" : "N"
|
||||
}
|
||||
}
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0"
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4644",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Gain Access"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"refsource" : "CONFIRM",
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253355",
|
||||
"title" : "IBM Security Bulletin 6253355 (Planning Analytics)",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253355"
|
||||
},
|
||||
{
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/185716",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"name" : "ibm-planning-cve20204644-clickjacking (185716)",
|
||||
"refsource" : "XF"
|
||||
}
|
||||
]
|
||||
},
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Planning Analytics Local 2.0.0 through 2.0.9.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 185716."
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.0.0"
|
||||
},
|
||||
{
|
||||
"version_value" : "2.0.9.1"
|
||||
}
|
||||
]
|
||||
},
|
||||
"product_name" : "Planning Analytics"
|
||||
}
|
||||
]
|
||||
},
|
||||
"vendor_name" : "IBM"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"E" : "U",
|
||||
"RC" : "C",
|
||||
"RL" : "O"
|
||||
},
|
||||
"BM" : {
|
||||
"S" : "C",
|
||||
"UI" : "R",
|
||||
"PR" : "N",
|
||||
"SCORE" : "6.100",
|
||||
"I" : "L",
|
||||
"AV" : "N",
|
||||
"C" : "L",
|
||||
"AC" : "L",
|
||||
"A" : "N"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"STATE" : "PUBLIC",
|
||||
"ID" : "CVE-2020-4644",
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00"
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0"
|
||||
}
|
||||
|
||||
@ -1,18 +1,93 @@
|
||||
{
|
||||
"data_type": "CVE",
|
||||
"data_format": "MITRE",
|
||||
"data_version": "4.0",
|
||||
"CVE_data_meta": {
|
||||
"ID": "CVE-2020-4645",
|
||||
"ASSIGNER": "cve@mitre.org",
|
||||
"STATE": "RESERVED"
|
||||
},
|
||||
"description": {
|
||||
"description_data": [
|
||||
"description" : {
|
||||
"description_data" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "IBM Planning Analytics Local 2.0.0 through 2.0.9.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 185717."
|
||||
}
|
||||
]
|
||||
},
|
||||
"problemtype" : {
|
||||
"problemtype_data" : [
|
||||
{
|
||||
"description" : [
|
||||
{
|
||||
"lang" : "eng",
|
||||
"value" : "Cross-Site Scripting"
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
},
|
||||
"references" : {
|
||||
"reference_data" : [
|
||||
{
|
||||
"name" : "https://www.ibm.com/support/pages/node/6253355",
|
||||
"refsource" : "CONFIRM",
|
||||
"url" : "https://www.ibm.com/support/pages/node/6253355",
|
||||
"title" : "IBM Security Bulletin 6253355 (Planning Analytics)"
|
||||
},
|
||||
{
|
||||
"refsource" : "XF",
|
||||
"name" : "ibm-planning-cve20204645-xss (185717)",
|
||||
"title" : "X-Force Vulnerability Report",
|
||||
"url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/185717"
|
||||
}
|
||||
]
|
||||
},
|
||||
"affects" : {
|
||||
"vendor" : {
|
||||
"vendor_data" : [
|
||||
{
|
||||
"lang": "eng",
|
||||
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
|
||||
"vendor_name" : "IBM",
|
||||
"product" : {
|
||||
"product_data" : [
|
||||
{
|
||||
"product_name" : "Planning Analytics",
|
||||
"version" : {
|
||||
"version_data" : [
|
||||
{
|
||||
"version_value" : "2.0.0"
|
||||
},
|
||||
{
|
||||
"version_value" : "2.0.9.1"
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"data_format" : "MITRE",
|
||||
"impact" : {
|
||||
"cvssv3" : {
|
||||
"TM" : {
|
||||
"RL" : "O",
|
||||
"RC" : "C",
|
||||
"E" : "H"
|
||||
},
|
||||
"BM" : {
|
||||
"C" : "L",
|
||||
"I" : "L",
|
||||
"AV" : "N",
|
||||
"A" : "N",
|
||||
"AC" : "L",
|
||||
"S" : "C",
|
||||
"SCORE" : "5.400",
|
||||
"UI" : "R",
|
||||
"PR" : "L"
|
||||
}
|
||||
}
|
||||
},
|
||||
"CVE_data_meta" : {
|
||||
"ASSIGNER" : "psirt@us.ibm.com",
|
||||
"DATE_PUBLIC" : "2020-07-28T00:00:00",
|
||||
"ID" : "CVE-2020-4645",
|
||||
"STATE" : "PUBLIC"
|
||||
},
|
||||
"data_type" : "CVE",
|
||||
"data_version" : "4.0"
|
||||
}
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user