CVE-2018-1929

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Rational Engineering Lifecycle Manager 5.0 through 6.0.6 could allow a malicious user to be allowed to view any view if he knows the URL link of a the view, and access information that should not be able to see. IBM X-Force ID: 153120.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Rational Engineering Lifecycle Manager	5.0; 5.0.1; 5.0.2; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; 6.0.5; 6.0.6

References

http://www.ibm.com/support/docview.wss?uid=ibm10875372Patch, Vendor Advisory
http://www.securityfocus.com/bid/107423Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/153120VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10875372Patch, Vendor Advisory
http://www.securityfocus.com/bid/107423Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/153120VDB Entry, Vendor Advisory

Timeline

Published: Mar 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-192909.8In modules/HELPBOT_MODULE in Budabot 0.6 through 4.0, lax syntax validation allows remote attackers to perform a command injection attack ag CVE-2018-192916.5An issue was discovered in DiliCMS 2.4.0. There is a CSRF vulnerability that can delete a user or group via an admin/index.php/user/del/1 or CVE-2018-192957.8Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.CVE-2018-192968.8PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack.CVE-2018-193009.8On D-Link DAP-1530 (A1) before firmware version 1.06b01, DAP-1610 (A1) before firmware version 1.06b01, DWR-111 (A1) before firmware version CVE-2018-193016.1tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.CVE-2018-193115.4Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI, as demonstrated by the "Monitoring CVE-2018-193128.8Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 U CVE-2018-193188.8SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=manager&a=update to change the username and password of the super administrator account.CVE-2018-193196.5SRCMS 3.0.0 allows CSRF via admin.php?m=Admin&c=gifts&a=update to change goods prices with the super administrator's privileges.CVE-2018-19324.9IBM API Connect 5.0.0.0 through 5.0.8.4 is affected by a vulnerability in the role-based access control in the management server that could CVE-2018-193207.8The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26,