CVE-2018-1821

IBM Operational Decision Management 8.5, 8.6, 8.7, 8.8, and 8.9 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 150170.

• CWE-611

• http://www.securityfocus.com/bid/106325Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/150170VDB Entry, Vendor Advisory
• https://www.exploit-db.com/exploits/46017/Exploit, Third Party Advisory, VDB Entry
• https://www.ibm.com/support/docview.wss?uid=ibm10744149Vendor Advisory
• http://www.securityfocus.com/bid/106325Third Party Advisory, VDB Entry
• https://exchange.xforce.ibmcloud.com/vulnerabilities/150170VDB Entry, Vendor Advisory
• https://www.exploit-db.com/exploits/46017/Exploit, Third Party Advisory, VDB Entry
• https://www.ibm.com/support/docview.wss?uid=ibm10744149Vendor Advisory

Published

Dec 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-18203A vulnerability in the update mechanism of Subaru StarLink H…
• CVE-2018-18205Topvision CC8800 CMTS C-E devices allow remote attackers to …
• CVE-2018-18206In the client in Bytom before 1.0.6, checkTopicRegister in p…
• CVE-2018-18207Virtualmin 6.03 allows Frame Injection via the settings-edit…
• CVE-2018-18208Virtualmin 6.03 allows XSS via the query string, as demonstr…
• CVE-2018-18209XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/…
• CVE-2018-18210XSS exists in DiliCMS 2.4.0 via the admin/index.php/setting/…
• CVE-2018-18211PbootCMS 1.2.1 has SQL injection via the HTTP POST data to t…
• CVE-2018-18215In youke365 v1.1.5, admin/user.html has a CSRF vulnerability…
• CVE-2018-1822IBM FlashSystem 900 product GUI allows a specially crafted a…9.8
• CVE-2018-18223Open Design Alliance Drawings SDK 2019Update1 has a vulnerab…
• CVE-2018-18224A vulnerability exists in the file reading procedure in Open…