CVE-2018-1623

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 144408.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Security Privileged Identity Manager	2.1.1

References

http://www.ibm.com/support/docview.wss?uid=ibm10879093Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144408VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10879093Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/144408VDB Entry, Vendor Advisory

Timeline

Published: Apr 2, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-162307.5The BGP parser in tcpdump before 4.9.3 has a buffer over-read in print-bgp.c:bgp_attr_print() (MP_REACH_NLRI).CVE-2018-162317.5Michael Roth Software Personal FTP Server (PFTP) through 8.4f allows remote attackers to cause a denial of service (daemon crash) via an uns CVE-2018-162328.8An authenticated command injection vulnerability exists in IPFire Firewall before 2.21 Core Update 124 in backup.cgi. This allows an authent CVE-2018-162336.1MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.CVE-2018-162346.1MorningStar WhatWeb 0.4.9 has XSS via JSON report files.CVE-2018-162356.1Telligent Community 6.x, 7.x, 8.x, 9.x before 9.2.10.11796, 10.1.x before 10.1.10.11792, and 10.2.x before 10.2.3.4725 has XSS via the Feed CVE-2018-162366.1cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account, because the filename is mishandled during fr CVE-2018-162372.7An issue was discovered in damiCMS V6.0.1. There is Directory Traversal via '|' characters in the s parameter to admin.php, as demonstrated CVE-2018-162387.2An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tp CVE-2018-162399.8An issue was discovered in damiCMS V6.0.1. It relies on the PHP time() function for cookies, which makes it possible to determine the cookie CVE-2018-162425.3oBike relies on Hangzhou Luoping Smart Locker to lock bicycles, which allows attackers to bypass the locking mechanism by using Bluetooth Lo CVE-2018-162435.4SolarWinds Database Performance Analyzer (DPA) 11.1.468 and 12.0.3074 have several persistent XSS vulnerabilities, related to logViewer.iwc,