CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1156
https://notcve.org/view.php?id=CVE-2017-1156
05 May 2017 — IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592 WebSphere Portal de IBM versiones... • http://www.ibm.com/support/docview.wss?uid=swg22000153 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1120
https://notcve.org/view.php?id=CVE-2017-1120
27 Mar 2017 — IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000152. IBM WebSphere Portal 8.5 y 9.0 es vulnerable a secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad potencia... • http://www.ibm.com/support/docview.wss?uid=swg22000152 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •