CVE-2018-1853

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 151014.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
IBM	Spectrum Protect	7.1; 8.1

References

http://www.ibm.com/support/docview.wss?uid=ibm10870718Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/151014VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10870718Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/151014VDB Entry, Vendor Advisory

Timeline

Published: Apr 8, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-185309.8ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate CVE-2018-185319.8text/impl/DefaultTextCreator.java, text/impl/ChineseTextProducer.java, and text/impl/FiveLetterFirstNameTextCreator.java in kaptcha 2.3.2 us CVE-2018-185357.8The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers (MSRs CVE-2018-185367.8The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. Th CVE-2018-185375.5The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address.CVE-2018-185406.1TeaKKi 2.7 allows XSS via a crafted onerror attribute for a picture's URL.CVE-2018-185417.5In Teeworlds before 0.6.5, connection packets could be forged. There was no challenge-response involved in the connection build up. A remote CVE-2018-185446.5There is a memory leak in the function WriteMSLImage of coders/msl.c in ImageMagick 7.0.8-13 Q16, and the function ProcessMSLScript of coder CVE-2018-185456.1Fiyo CMS 2.0.7 has XSS via the dapur\apps\app_user\edit_user.php name parameter.CVE-2018-185469.8ThinkPHP 3.2.4 has SQL Injection via the order parameter because the Library/Think/Db/Driver.class.php parseOrder function mishandles the ke CVE-2018-185476.1Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period par CVE-2018-185486.1ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.