CVE-2017-1446 (emptoris_spend_analysis)
IBM Emptoris Spend Analysis 9.5.0.0 through 10.1.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128171.
CVE-2017-1441 (emptoris_services_procurement)
IBM Emptoris Services Procurement 10.0.0.5 could allow a local user to view sensitive information stored locally due to improper access control. IBM X-Force ID: 128106.
CVE-2017-1442 (emptoris_services_procurement)
IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 128107.
CVE-2017-14037 (crushftp)
CrushFTP before 7.8.0 and 8.x before 8.2.0 has an HTTP header vulnerability.
Source: CVE-2017-14037 (crushftp)
CVE-2017-14035 (crushftp)
CrushFTP 8.x before 8.2.0 has a serialization vulnerability.
Source: CVE-2017-14035 (crushftp)
CVE-2017-1443 (emptoris_services_procurement)
IBM Emptoris Services Procurement 10.0.0.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 128109.
CVE-2017-1440 (emptoris_services_procurement)
IBM Emptoris Services Procurement 10.0.0.5 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL to specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable Web server. IBM X-Force ID: 128105.
CVE-2017-14038 (crushftp)
CrushFTP before 7.8.0 and 8.x before 8.2.0 has a redirect vulnerability.
Source: CVE-2017-14038 (crushftp)
CVE-2017-14036 (crushftp)
CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.
Source: CVE-2017-14036 (crushftp)