CVE-2018-1432

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM InfoSphere Information Server 9.1, 11.3, 11.5, and 11.7 is vulnerable to cross-frame scripting which is a vulnerability that allows an attacker to load Information Server components inside an HTML iframe tag on a malicious page. The attacker could use this weakness to devise a Clickjacking attack to conduct phishing, frame sniffing, social engineering or Cross-Site Request Forgery attacks. IBM X-Force ID: 139360.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-352 CWE-1021

Affected software

Vendor	Product	Versions
IBM	InfoSphere Information Server	9.1; 11.3; 11.5; 11.7

References

http://www.ibm.com/support/docview.wss?uid=swg22014911Vendor Advisory
http://www.securitytracker.com/id/1041039Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139360Third Party Advisory, VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg22014911Vendor Advisory
http://www.securitytracker.com/id/1041039Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/139360Third Party Advisory, VDB Entry

Timeline

Published: Jun 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-143206.5This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of PoDoFo. User interaction is requ CVE-2018-143249.8The demo feature in Oracle GlassFish Open Source Edition 5.0 has TCP port 7676 open by default with a password of admin for the admin accoun CVE-2018-143258.8In MP4v2 2.0.0, there is an integer underflow (with resultant memory corruption) when parsing MP4Atom in mp4atom.cpp.CVE-2018-143268.8In MP4v2 2.0.0, there is an integer overflow (with resultant memory corruption) when resizing MP4Array for the ftyp atom in mp4array.h.CVE-2018-143277.8The installer for the Alcatel OSPREY3_MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE40_00_02.00_45 set CVE-2018-143289.8Brynamics "Online Trade - Online trading and cryptocurrency investment system" allows remote attackers to obtain sensitive information via a CVE-2018-143294.7In HTSlib 1.8, a race condition in cram/cram_io.c might allow local users to overwrite arbitrary files via a symlink attack.CVE-2018-14337.5IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-143318.8An issue was discovered in XiaoCms X1 v20140305. There is a CSRF vulnerability to change the administrator account password via admin/index.CVE-2018-143325.5An issue was discovered in Clementine Music Player 1.3.1. Clementine.exe is vulnerable to a user mode write access violation due to a NULL p CVE-2018-143338.1TeamViewer through 13.1.1548 stores a password in Unicode format within TeamViewer.exe process memory between "[00 88] and "[00 00 00]" deli CVE-2018-143349.8manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary file upload because detection of a prohibited file extension simply sets the