CVE-2018-1536

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142558.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Rational Software Architect Design Manager	5.0; 5.0.2; 5.0.1; 6.0; 6.0.1
IBM	Rational Rhapsody Design Manager	5.0; 5.0.2; 5.0.1; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5

References

http://www.ibm.com/support/docview.wss?uid=ibm10716029Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/142558VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10716029Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/142558VDB Entry, Vendor Advisory

Timeline

Published: Jul 19, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-153607.3An attacker without authentication can login with default credentials for privileged users in Eltex ESP-200 firmware version 1.2.0.CVE-2018-153619.8UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. This attack CVE-2018-153629.1XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 CVE-2018-153637.8An Out-of-Bounds Read Privilege Escalation vulnerability in Trend Micro Security 2018 (Consumer) products could allow a local attacker to es CVE-2018-153644.7A Named Pipe Request Processing Out-of-Bounds Read Information Disclosure vulnerability in Trend Micro OfficeScan XG (12.0) could allow a lo CVE-2018-153655.4A Reflected Cross-Site Scripting (XSS) vulnerability in Trend Micro Deep Discovery Inspector 3.85 and below could allow an attacker to bypas CVE-2018-153667.8A UrlfWTPPagePtr KERedirect Use-After-Free Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017) and abo CVE-2018-153677.8A ctl_set KERedirect Untrusted Pointer Dereference Privilege Escalation vulnerability in Trend Micro Antivirus for Mac (Consumer) 7.0 (2017)CVE-2018-153686.7A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to gain access to the underlying Lin CVE-2018-153696.8A vulnerability in the TACACS+ client subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac CVE-2018-153706.8A vulnerability in Cisco IOS ROM Monitor (ROMMON) Software for Cisco Catalyst 6800 Series Switches could allow an unauthenticated, local att CVE-2018-153716.7A vulnerability in the shell access request mechanism of Cisco IOS XE Software could allow an authenticated, local attacker to bypass authen