CVE-2017-1462

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Rhapsody DM 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128461.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Rational Rhapsody Design Manager	5.0; 5.0.1; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4
IBM	Rational Rhapsody Design Manager	5.0.2

References

http://www.ibm.com/support/docview.wss?uid=swg22013739Patch, Vendor Advisory
http://www.securityfocus.com/bid/103127Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040393Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128461VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22013739Patch, Vendor Advisory
http://www.securityfocus.com/bid/103127Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040393Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128461VDB Entry, Vendor Advisory

Timeline

Published: Feb 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-146206.1SmarterStats Version 11.3.6347 will Render the Referer Field of HTTP Logfiles from URL /Data/Reports/ReferringURLsWithQueries resulting in S CVE-2017-146215.4Portus 2.2.0 has XSS via the Team field, related to typeahead.CVE-2017-146226.1Multiple cross-site scripting (XSS) vulnerabilities in the 2kb Amazon Affiliates Store plugin before 2.1.1 for WordPress allow remote attack CVE-2017-146238.1In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an ap CVE-2017-146249.8ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.CVE-2017-146259.8ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.CVE-2017-146269.8ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.CVE-2017-146277.8Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code via the (1) author (inside the INF CVE-2017-146289.8In sam2p 0.49.3, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.CVE-2017-146297.5In sam2p 0.49.3, the in_xpm_reader function in in_xpm.cpp has an integer signedness error, leading to a crash when writing to an out-of-boun CVE-2017-146309.8In sam2p 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.CVE-2017-146319.8In sam2p 0.49.3, the pcxLoadRaster function in in_pcx.cpp has an integer signedness error leading to a heap-based buffer overflow.