WordPress user-access-manager plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. user-access-manager is a user site management plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

IBM Security Access Manager for Enterprise Single-Sign On XML External Entity Injection Vulnerability

IBM Security Access Manager for Enterprise Single-Sign On is a suite of authentication and authorization management solutions for enterprise single sign-on from IBM in the United States. An XML external entity injection vulnerability exists in IBM Security Access Manager for Enterprise Single-Sig...

CVE-2011-5328

The user-access-manager plugin before 1.2 for WordPress has CSRF...

Cross site request forgery (csrf)

The user-access-manager plugin before 1.2 for WordPress has CSRF...

CVE-2011-5328

CVE-2011-5328: WordPress User Access Manager plugin before 1.2 suffers CSRF. Affected component: user-access-manager plugin (WordPress). Root cause: requests can be forged cross-site. Impact stated as CSRF; exploitation status not provided in the documents. Remediation: upgrade to version 1.2 or ...

Exploit for Cleartext Transmission of Sensitive Information in Oneidentity Cloud_Access_Manager

CVE-2019-13498 Exploit Title: MITM - Missing HSTS causing cre...

CVE-2019-13498

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

CVE-2019-13498

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

Design/Logic Flaw

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

CVE-2019-13498

One Identity Cloud Access Manager 8.1.3 does not use HTTP Strict Transport Security HSTS, which may allow man-in-the-middle MITM attacks. This issue is fixed in version 8.1.4...

CVE-2019-13498

The CVE-2019-13498 issue affects One Identity Cloud Access Manager 8.1.3, where HTTP Strict Transport Security (HSTS) is not implemented. This absence can enable MITM-style attacks by downgrading protections, with the impact described as enabling/intercepting sensitive credential-related traffic....

CVE-2019-4135

IBM Security Access Manager 9.0.1 through 9.0.6 is affected by a security vulnerability that could allow authenticated users to impersonate other users. IBM X-Force ID: 158331...

CVE-2019-4152

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 158515...

CVE-2019-4153

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user ...

CVE-2019-4151

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512...

CVE-2019-4145

IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 158400...

CVE-2019-4157

IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2019-4150

IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. IBM X-Force ID: 158510...

CVE-2019-4150

IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. IBM X-Force ID: 158510...

CVE-2019-4158

IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality to unintended actors. IBM X-Force ID: 158574...