CVE-2017-1370

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

IBM Jazz Reporting Service (JRS) 5.0 and 6.0 could disclose sensitive information, including user credentials, through an error message from the Report Builder administrator configuration page. IBM X-Force ID: 126863.

Metrics

CVSS 3.0 4.9/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
IBM	Jazz Reporting Service	5.0; 5.0.1; 5.0.2; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4

References

http://www.ibm.com/support/docview.wss?uid=swg22005868Vendor Advisory
http://www.securityfocus.com/bid/99954Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126863VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22005868Vendor Advisory
http://www.securityfocus.com/bid/99954Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126863VDB Entry, Vendor Advisory

Timeline

Published: Jul 31, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-137004.8An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface.CVE-2017-137019.8An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. The backup file contains sensitive information in a insecure way. Ther CVE-2017-137025.3An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. Cookies can be stolen, manipulated, and reused.CVE-2017-137037.5An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. A denial of service may occur.CVE-2017-137047.5In dnsmasq before 2.78, if the DNS packet size does not match the expected size, the size parameter in a memset call gets a negative value. CVE-2017-137069.9XML external entity (XXE) vulnerability in the import package functionality of the deployment module in Lansweeper before 6.0.100.67 allows CVE-2017-137079.8Privilege escalation in Replibit Backup Manager earlier than version 2017.08.04 allows attackers to gain root privileges via sudo command ex CVE-2017-137089.8Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GE CVE-2017-137097.5In FlightGear before version 2017.3.1, Main/logger.cxx in the FGLogger subsystem allows one to overwrite any file via a resource that affect CVE-2017-13718.8Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated u CVE-2017-137107.5The setup_group function in elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, allows remo CVE-2017-137117.5Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of ser