CVE-2017-1355

LowCVSS 3.7/10Last modified Jun 17, 2026

Description

IBM Atlas eDiscovery Process Management 6.0.3 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126682.

Metrics

CVSS 3.0 3.7/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Atlas eDiscovery Process Management	6.0.3; 6.0.3.2; 6.0.3.3; 6.0.3.4; 6.0.3.5

References

http://www.securityfocus.com/bid/102016Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126682Issue Tracking, VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg22005836Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/102016Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126682Issue Tracking, VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg22005836Issue Tracking, Vendor Advisory

Timeline

Published: Dec 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-13568.8IBM Atlas eDiscovery Process Management 6.0.3 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements,CVE-2017-13574.3IBM Maximo Asset Management 7.5 and 7.6 could allow an authenticated user to manipulate work orders to forge emails which could be used to c CVE-2017-13595.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-13627.8IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-F CVE-2017-13635.4IBM Team Concert (RTC) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web CVE-2017-13645.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-136486.5In GraphicsMagick 1.3.26, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c.CVE-2017-136495.5UnrealIRCd 4.0.13 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbi CVE-2017-13655.4IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. T CVE-2017-136526.5NetApp OnCommand Insight version 7.3.0 and versions prior to 7.2.0 are susceptible to clickjacking attacks which could cause a user to perfo CVE-2017-136586.5In ImageMagick before 6.9.9-3 and 7.x before 7.0.6-3, there is a missing NULL check in the ReadMATImage function in coders/mat.c, leading to CVE-2017-13667.5IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow a