CVE-2017-1794

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Tivoli Monitoring 6.2.3 through 6.2.3.5 and 6.3.0 through 6.3.0.7 are vulnerable to both TEPS user privilege escalation and possible denial of service due to unconstrained memory growth. IBM X-Force ID: 137039.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
IBM	Tivoli Monitoring	6.2.3; 6.2.3.1; 6.2.3.2; 6.3.0; 6.2.3.3; 6.2.3.4; 6.2.3.5; 6.3.0.1; 6.3.0.2; 6.3.0.3; 6.3.0.4; 6.3.0.5; 6.3.0.6; 6.3.0.7

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/137039VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg22014097Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/137039VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=swg22014097Vendor Advisory

Timeline

Published: Sep 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-179404.8PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.CVE-2017-179417.2PHP Scripts Mall Single Theater Booking has SQL Injection via the admin/movieview.php movieid parameter.CVE-2017-179428.8In LibTIFF 4.0.9, there is a heap-based buffer over-read in the function PackBitsEncode in tif_packbits.c.CVE-2017-179449.1The ASUS Vivobaby application before 1.1.09 for Android has Missing SSL Certificate Validation.CVE-2017-179459.1The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.CVE-2017-179469.8A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data CVE-2017-179474.8A cross site scripting issue has been found in custompage.cgi in Pulse Secure Pulse Connect Secure (PCS) before 8.0R17.0, 8.1.x before 8.1R1 CVE-2017-179486.1Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.CVE-2017-179496.1Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.CVE-2017-17954.4IBM WebSphere MQ 7.5, 8.0, and 9.0 through 9.0.4 could allow a local user to obtain highly sensitive information via trace logs in IBM WebSp CVE-2017-179508.8Cells Blog 3.5 has SQL Injection via the pub_readpost.php ptid parameter.CVE-2017-179519.8PHP Scripts Mall PHP Multivendor Ecommerce has SQL Injection via the shopping-cart.php cusid parameter.