CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1156
https://notcve.org/view.php?id=CVE-2017-1156
IBM WebSphere Portal 8.5 and 9.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force. ID: 122592 WebSphere Portal de IBM versiones 8.5 y 9.0, podría permitir a un atacante remoto conducir ataques de phishing, utilizando un ataque de redireccionamiento abierto. • http://www.ibm.com/support/docview.wss?uid=swg22000153 http://www.securityfocus.com/bid/98340 http://www.securitytracker.com/id/1038390 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2017-1120
https://notcve.org/view.php?id=CVE-2017-1120
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 2000152. IBM WebSphere Portal 8.5 y 9.0 es vulnerable a secuencias de comandos de sitios cruzados. Esta vulnerabilidad permite a usuarios incrustar código JavaScript arbitrario en la IU Web alterando así la funcionalidad potencialmente prevista dirigida a la divulgación de credenciales dentro de una sesión de confianza. • http://www.ibm.com/support/docview.wss?uid=swg22000152 http://www.securityfocus.com/bid/97075 http://www.securitytracker.com/id/1038146 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •