CVE-2017-1521

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Tivoli Endpoint Manager (for Lifecycle/Power/Patch) Platform and Applications (IBM BigFix Platform 9.2 and 9.5) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129831.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.ibm.com/support/docview.wss?uid=swg22009673Patch, Vendor Advisory
http://www.securityfocus.com/bid/101571Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/129831VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22009673Patch, Vendor Advisory
http://www.securityfocus.com/bid/101571Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/129831VDB Entry, Vendor Advisory

Timeline

Published: Oct 26, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-152104.3In Kanboard before 1.0.47, by altering form data, an authenticated user can see thumbnails of pictures from a private project of another use CVE-2017-152114.3In Kanboard before 1.0.47, by altering form data, an authenticated user can add an external link to a private project of another user.CVE-2017-152124.3In Kanboard before 1.0.47, by altering form data, an authenticated user can at least see the names of tags of a private project of another u CVE-2017-152135.4Stored XSS vulnerability in Flyspray before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileges, via CVE-2017-152145.4Stored XSS vulnerability in Flyspray 1.0-rc4 before 1.0-rc6 allows an authenticated user to inject JavaScript to gain administrator privileg CVE-2017-152156.1Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.CVE-2017-152166.1MISP before 2.4.81 has a potential reflected XSS in a quickDelete action that is used to delete a sighting, related to app/View/Sightings/aj CVE-2017-152176.5ImageMagick 7.0.7-2 has a memory leak in ReadSGIImage in coders/sgi.c.CVE-2017-152186.5ImageMagick 7.0.7-2 has a memory leak in ReadOneJNGImage in coders/png.c.CVE-2017-152195.4The dotCMS 4.1.1 application is vulnerable to Stored Cross-Site Scripting (XSS) affecting a vanity-urls Title field, a containers Descriptio CVE-2017-15225.4IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra CVE-2017-152209.8Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ subst