CVE-2018-1991

LowCVSS 2.7/10Last modified Jun 17, 2026

Description

IBM API Connect 5.0.0.0, and 5.0.8.6 could could return sensitive information that could provide critical information as to the underlying software stack in CMC UI headers. IBM X-Force ID: 154284.

Metrics

CVSS 3.0 2.7/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	API Connect	5.0.0.0; 5.0.8.6

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/154284VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10871970Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/154284VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10871970Vendor Advisory

Timeline

Published: May 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-199117.5FreeSWITCH through 1.8.2, when mod_xml_rpc is enabled, allows remote attackers to execute arbitrary commands via the api/system or txtapi/sy CVE-2018-199134.8DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName, Reseller ID, or notes field.CVE-2018-199144.8DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.CVE-2018-199154.8DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.CVE-2018-199176.1Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.CVE-2018-199185.4CuppaCMS has XSS via an SVG document uploaded to the administrator/#/component/table_manager/view/cu_views URI.CVE-2018-199194.8Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php data[title] parameter, as demonstrated by a crafted onload attribute of an SVG CVE-2018-19926.4The IBM Power 9 OP910, OP920, and FW910 boot firmware's bootloader is responsible for loading and validating the initial boot firmware image CVE-2018-199216.1Zoho ManageEngine OpManager 12.3 before 123237 has XSS in the domain controller.CVE-2018-199226.1Persistent Cross-Site Scripting (XSS) in the advancedsetup_websiteblocking.html Website Blocking page of the Actiontec C1000A router with fi CVE-2018-199238.8An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF.CVE-2018-199246.1An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the requ