CVE-2017-1522

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Content Navigator & CMIS 2.0.3, 3.0.0, and 3.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 129832.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Content Navigator	2.0.3; 3.0.0; 3.0.1

References

http://www.ibm.com/support/docview.wss?uid=swg22008162Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/129832VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22008162Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/129832VDB Entry, Vendor Advisory

Timeline

Published: Oct 5, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-152209.8Flexense VX Search Enterprise 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ subst CVE-2017-152217.8ASX to MP3 converter 3.1.3.7.2010.11.05 has a buffer overflow via a crafted M3U file, a related issue to CVE-2009-1324.CVE-2017-152229.8Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.CVE-2017-152235.3Denial-of-service vulnerability in ArGoSoft Mini Mail Server 1.0.0.2 and earlier allows remote attackers to waste CPU resources (memory cons CVE-2017-152255.5_bfd_dwarf2_cleanup_debug_info in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, al CVE-2017-152269.8Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a CVE-2017-152277.5Irssi before 1.0.5, while waiting for the channel synchronisation, may incorrectly fail to remove destroyed channels from the query list, re CVE-2017-152287.5Irssi before 1.0.5, when installing themes with unterminated colour formatting sequences, may access data beyond the end of the string.CVE-2017-15237.5IBM InfoSphere Master Data Management - Collaborative Edition 11.5 could allow an unauthorized user to download reports without authenticati CVE-2017-152326.5libjpeg-turbo 1.5.2 has a NULL Pointer Dereference in jdpostct.c and jquant1.c via a crafted JPEG file.CVE-2017-152357.5The File Manager (gollem) module 3.0.11 in Horde Groupware 5.2.21 allows remote attackers to bypass Horde authentication for file downloads CVE-2017-152367.5Tiandy IP cameras 5.56.17.120 do not properly restrict a certain proprietary protocol, which allows remote attackers to read settings via a