CVE-2018-1663

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

IBM DataPower Gateways 7.5, 7.5.1, 7.5.2, 7.6, and 2018.4 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 144889.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Dec 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-166304.8Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.CVE-2018-166315.4Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.CVE-2018-166324.8Mezzanine CMS v4.3.1 allows XSS via the /admin/blog/blogcategory/add/?_to_field=id&_popup=1 title parameter at admin/blog/blogpost/add/.CVE-2018-166335.4Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.CVE-2018-166348.8Pluck v4.7.7 allows CSRF via admin.php?action=settings.CVE-2018-166355.4Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.CVE-2018-166366.5Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.CVE-2018-166375.4Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.CVE-2018-166385.4Evolution CMS 1.4.x allows XSS via the manager/ search parameter.CVE-2018-166395.4Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.CVE-2018-16647.8IBM DataPower Gateway 7.1.0.0 - 7.1.0.23, 7.2.0.0 - 7.2.0.21, 7.5.0.0 - 7.5.0.16, 7.5.1.0 - 7.5.1.15, 7.5.2.0 - 7.5.2.15, and 7.6.0.0 - 7.6.CVE-2018-166406.5ImageMagick 7.0.8-5 has a memory leak vulnerability in the function ReadOneJNGImage in coders/png.c.