CVE-2018-1441

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.3 and 8.1.4) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 139597.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Monitoring	8.1.3; 8.1.4

References

http://www.ibm.com/support/docview.wss?uid=swg22013557Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/139597VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22013557Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/139597VDB Entry, Vendor Advisory

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-144156.1An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=CVE-2018-144179.8A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv scrip CVE-2018-144189.8In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI.CVE-2018-144194.8MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on the home page.CVE-2018-14428.8IBM Application Performance Management - Response Time Monitoring Agent (IBM Monitoring 8.1.4) is vulnerable to cross-site request forgery w CVE-2018-144208.8MetInfo 6.0.0 allows a CSRF attack to add a user account via a doaddsave action to admin/index.php, as demonstrated by an admin/index.php?an CVE-2018-144218.8SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /bac CVE-2018-144226.1blog/index.php in SansCMS 0.7 has XSS via the q parameter.CVE-2018-144237.5Division-by-zero vulnerabilities in the functions pi_next_pcrl, pi_next_cprl, and pi_next_rpcl in lib/openjp3d/pi.c in OpenJPEG through 2.3.CVE-2018-144247.8The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a CVE-2018-144256.1There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 CVE-2018-144297.5man-cgi before 1.16 allows Local File Inclusion via absolute path traversal, as demonstrated by a cgi-bin/man-cgi?/etc/passwd URI.