CVE-2017-1679

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

IBM OpenPages GRC Platform 7.2, 7.3, 7.4, and 8.0 could allow an attacker to obtain sensitive information from error log files. IBM X-Force ID: 134001.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	OpenPages GRC Platform	7.2; 7.3; 7.4; 8.0

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/134001VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728737Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/134001VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10728737Patch, Vendor Advisory

Timeline

Published: Sep 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-167906.5An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. When a form is submitted by the user, th CVE-2017-167926.1Stored cross-site scripting (XSS) vulnerability in "geminabox" (Gem in a Box) before 0.13.10 allows attackers to inject arbitrary web script CVE-2017-167937.8The wav_convert2mono function in lib/wav.c in SWFTools 0.9.2 does not properly validate WAV data, which allows remote attackers to cause a d CVE-2017-167945.5The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which a CVE-2017-167967.8In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to ca CVE-2017-167977.8In SWFTools 0.9.2, the png_load function in lib/png.c does not properly validate an alloclen_64 multiplication of width and height values, w CVE-2017-167985.4In CMS Made Simple 2.2.3.1, the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin CVE-2017-167995.4In CMS Made Simple 2.2.3.1, in modules/New/action.addcategory.php, stored XSS is possible via the m1_name parameter to admin/moduleinterface CVE-2017-168015.4Cross-site scripting (XSS) vulnerability in Octopus Deploy 3.7.0-3.17.13 (fixed in 3.17.14) allows remote authenticated users to inject arbi CVE-2017-168025.4In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82, there is XSS via a crafted organisation name tha CVE-2017-168037.5In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree function in libavcodec/smacker.c does not properly restrict tree recur CVE-2017-168044.3In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function in app/models/mailer.rb does not check whether an issue is visible, w