CVE-2018-1905

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

IBM WebSphere Application Server 9.0.0.0 through 9.0.0.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 152534.

Metrics

CVSS 3.0 7.1/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
IBM	WebSphere Application Server	9.0.0.0; 9.0.0.1; 9.0.0.2; 9.0.0.3; 9.0.0.4; 9.0.0.5; 9.0.0.6

References

http://www.securityfocus.com/bid/106030Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152534VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10738721Mitigation, Vendor Advisory
http://www.securityfocus.com/bid/106030Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/152534VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10738721Mitigation, Vendor Advisory

Timeline

Published: Nov 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-190506.1MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.CVE-2018-190516.1MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.CVE-2018-190527.5An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50. There is potential ../ path traversal of a s CVE-2018-190537.2PbootCMS 1.2.2 allows remote attackers to execute arbitrary PHP code by specifying a .php filename in a "SET GLOBAL general_log_file" statem CVE-2018-190566.1pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.CVE-2018-190576.1SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandle CVE-2018-190586.5An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in CVE-2018-190596.5An issue was discovered in Poppler 0.71.0. There is a out-of-bounds read in EmbFile::save2 in FileSpec.cc, will lead to denial of service, a CVE-2018-19066.5IBM InfoSphere Information Server 11.3, 11.5, and 11.7could allow an authenticated user to download code using a specially crafted HTTP requ CVE-2018-190606.5An issue was discovered in Poppler 0.71.0. There is a NULL pointer dereference in goo/GooString.h, will lead to denial of service, as demons CVE-2018-190619.8DedeCMS 5.7 SP2 has SQL Injection via the dede\co_do.php ids parameter.CVE-2018-190639.8An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with S