CVE-2018-1900

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

IBM Curam Social Program Management 6.0.5, 6.1.1, 6.2.0, 7.0.1, and 7.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 152529.

Metrics

CVSS 3.0 5.4/10CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
IBM	Curam Social Program Management	6.0.5; 6.1.1; 6.2.0; 7.0.1; 7.0.4

References

http://www.securityfocus.com/bid/106189Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152529VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10739035Patch, Vendor Advisory
http://www.securityfocus.com/bid/106189Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152529VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10739035Patch, Vendor Advisory

Timeline

Published: Dec 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190005.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows an authentication bypass, which may allow an attacker access to sensitive data.CVE-2018-190014.3Philips HealthSuite Health Android App, all versions. The software uses simple encryption that is not strong enough for the level of protect CVE-2018-190027.8LCDS Laquis SCADA prior to version 4.1.0.4150 allows improper control of generation of code when opening a specially crafted project file, w CVE-2018-190037.5GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All ve CVE-2018-190043.3LCDS Laquis SCADA prior to version 4.1.0.4150 allows out of bounds read when opening a specially crafted project file, which may allow data CVE-2018-190057.8Cscape, Version 9.80.75.3 SP3 and prior. An improper input validation vulnerability has been identified that may be exploited by processing CVE-2018-190064.8OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displ CVE-2018-190079.8In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable t CVE-2018-190087.8The TextEditor 2.0 in ABB CP400 Panel Builder versions 2.0.7.05 and earlier contain a vulnerability in the file parser of the Text Editor wh CVE-2018-190097.8Pilz PNOZmulti Configurator prior to version 10.9 allows an authenticated attacker with local access to the system containing the PNOZmulti CVE-2018-19018.8IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to temporarily gain elevated privileges on the system, caused by CVE-2018-190106.5Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. A