CVE-2018-1461

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140362.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
IBMSpectrum Virtualize Software7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 6.4; 7.1; 7.2; 7.3; 7.4; 8.1.1
IBMStorwize V50007.1; 7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 6.4; 7.2; 7.3; 7.4; 8.1.1
IBMStorwize V35006.4; 7.1; 7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 7.2; 7.3; 7.4; 8.1.1
IBMStorwize V7000 (2076)6.1; 6.2; 6.3; 6.4; 7.1; 7.2; 7.3; 7.4; 1.1; 7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 8.1.1
IBMStorwize V37007.1; 6.4; 7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 7.2; 7.3; 7.4; 8.1.1
IBMFlashSystem V90007.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 6.4; 7.1; 7.2; 7.3; 7.4; 8.1.1
IBMSAN Volume Controller6.1; 6.2; 6.3; 6.4; 7.1; 7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1
IBMSpectrum Virtualize for Public Cloud7.5; 7.6; 7.6.1; 7.7; 7.7.1; 7.8; 7.8.1; 8.1; 6.1; 6.2; 6.3; 6.4; 7.1; 7.2; 7.3; 7.4; 8.1.1

References

Timeline

Published
May 17, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-146105.5An issue was discovered in the Linux kernel through 4.17.10. There is out-of-bounds access in write_extent_buffer() when mounting and operatCVE-2018-146115.5An issue was discovered in the Linux kernel through 4.17.10. There is a use-after-free in try_merge_free_space() when mounting a crafted btrCVE-2018-146125.5An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in btrfs_root_node() when mounting a crCVE-2018-146135.5An issue was discovered in the Linux kernel through 4.17.10. There is an invalid pointer dereference in io_ctl_map_page() when mounting and CVE-2018-146145.5An issue was discovered in the Linux kernel through 4.17.10. There is an out-of-bounds access in __remove_dirty_segment() in fs/f2fs/segmentCVE-2018-146155.5An issue was discovered in the Linux kernel through 4.17.10. There is a buffer overflow in truncate_inline_inode() in fs/f2fs/inline.c when CVE-2018-146165.5An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference in fscrypt_do_page_crypto() in fs/crypto/crCVE-2018-146175.5An issue was discovered in the Linux kernel through 4.17.10. There is a NULL pointer dereference and panic in hfsplus_lookup() in fs/hfsplusCVE-2018-146189.8curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hasCVE-2018-146197.8A flaw was found in the crypto subsystem of the Linux kernel before version kernel-4.15-rc4. The "null skcipher" was being dropped when eachCVE-2018-14627.6IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5,CVE-2018-146209.8The OpenStack RabbitMQ container image insecurely retrieves the rabbitmq_clusterer component over HTTP during the build stage. This could po
CVE-2018-1461: Medium severity, CVSS 5.4 | Vulnix