CVE-2017-1240

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Rhapsody DM products could reveal sensitive information in HTTP 500 Internal Server Error responses. IBM X-Force ID: 124359.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Rational Collaborative Lifecycle Management	4.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6; 5.0; 4.0.7; 5.0.1; 5.0.2; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4

References

http://www.ibm.com/support/docview.wss?uid=swg22010512Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/101976Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/124359Issue Tracking, VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22010512Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/101976Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/124359Issue Tracking, VDB Entry, Vendor Advisory

Timeline

Published: Nov 27, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-12414.3An unspecified vulnerability in IBM Jazz Foundation based applications might allow the display of stack trace information to an attacker. IB CVE-2017-124107.4It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Admini CVE-2017-124127.8ccn-lite-ccnb2xml in CCN-lite before 2.0.0 allows context-dependent attackers to have unspecified impact via a crafted file, which triggers CVE-2017-124136.1AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.CVE-2017-124149.8Format Factory 4.1.0 has a DLL Hijacking Vulnerability because an untrusted search path is used for msimg32.dll, WindowsCodecs.dll, and dwma CVE-2017-124157.5OXID eShop Community Edition before 6.0.0 RC2 (development), 4.10.x before 4.10.5 (maintenance), and 4.9.x before 4.9.10 (legacy), Enterpris CVE-2017-124166.1Cross-site scripting (XSS) vulnerability in the GlobalProtect internal and external gateway interface in Palo Alto Networks PAN-OS before 6.CVE-2017-124187.5ImageMagick 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in Magi CVE-2017-124194.9If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as re CVE-2017-12425.4IBM Quality Manager (RQM) 5.0.x and 6.0 through 6.0.5 are vulnerable to HTML injection. A remote attacker could inject malicious HTML code, CVE-2017-124208.8Heap-based buffer overflow in the SMB implementation in NetApp Clustered Data ONTAP before 8.3.2P8 and 9.0 before P2 allows remote authentic CVE-2017-124218.8NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows remote authenticated users to execute arbitrary code on the storage controller via