Security Bulletin: IBM Security Access Manager Appliance is affected by a vulnerability in Python (CVE-2014-9365)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability in the Python libraries used on the appliance. Vulnerability Details CVEID: CVE-2014-9365 DESCRIPTION: Python could allow a remote attacker to bypass security restrictions, caused by the failure to validate TL...

Security Bulletin: IBM Security Access Manager Appliance is affected by a cURL vulnerability (CVE-2016-7167)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability in the cURL libraries used on the appliance. Vulnerability Details CVEID: CVE-2016-7167 DESCRIPTION: libcurl could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow ...

Security Bulletin: IBM Security Access Manager Appliance is affected by a vulnerability (CVE-2017-1478)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability due to locally stored web pages. Vulnerability Details CVEID: CVE-2017-1478 DESCRIPTION: IBM Security Access Manager Appliance allows web pages to be stored locally which can be read by another user on the...

Security Bulletin: IBM Security Access Manager Appliance is affected by a vulnerability (CVE-2017-1459)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability related to the permissions set on a critical resource. Vulnerability Details CVEID: CVE-2017-1459 DESCRIPTION: IBM Security Access Manager Appliance specifies permissions for a security-critical resource in a...

Security Bulletin: IBM Security Access Manager Appliance is affected by OpenSSH vulnerabilities

Summary IBM Security Access Manager Appliance has addressed the following vulnerabilities in the OpenSSH libraries used on the appliance. Vulnerability Details CVEID: CVE-2016-6515 DESCRIPTION: OpenSSH is vulnerable to a denial of service, caused by the failure to limit password lengths for...

Security Bulletin: IBM Security Access Manager Appliance is affected by a cross-site scripting vulnerability (CVE-2017-1533)

Summary IBM Security Access Manager Appliance has addressed the following cross-site scripting vulnerability. Vulnerability Details CVEID: CVE-2017-1533 DESCRIPTION: IBM Security Access Manager Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary...

Security Bulletin: IBM Security Access Manager Appliance is affected by GnuTLS vulnerabilities

Summary IBM Security Access Manager Appliance has addressed the following vulnerabilities in the GnuTLS packages used by the appliance. Vulnerability Details CVEID: CVE-2017-7869 DESCRIPTION: GnuTLS is vulnerable to a denial of service, caused by an integer overflow and heap-based buffer overflow...

Security Bulletin: IBM Security Access Manager Appliance is affected by a potential information exposure vulnerability (CVE-2017-1480)

Summary IBM Security Access Manager Appliance has addressed the following information exposure vulnerability. Vulnerability Details CVEID: CVE-2017-1480 DESCRIPTION: IBM Security Access Manager Appliance stores potentially sensitive information in log files that could be read by a remote user. CV...

Security Bulletin: IBM Security Access Manager Appliance is affected by an encryption vulnerability (CVE-2017-1473)

Summary IBM Security Access Manager Appliance has addressed the following weak encryption vulnerability. Vulnerability Details CVEID: CVE-2017-1473 DESCRIPTION: IBM Security Access Manager Appliance uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly...

Security Bulletin: Multiple Security Vulnerabilities have been identified in IBM® SDK, Java™ Technology Edition shipped with IBM Security Access Manager for Enterprise Single-Sign On

Summary IBM® SDK, Java™ Technology Edition is shipped as a component of IBM Security Access Manager for Enterprise Single-Sign On. Information about the vulnerabilities affecting IBM® SDK, Java™ Technology Edition have been published in a Security Bulletin. Vulnerability Details Consult the...

Security Bulletin: IBM Security Access Manager Appliance is affected by a kernel vulnerability (CVE-2016-10229)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2016-10229 DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in udp.c. By sending specially-crafted UDP packets...

Security Bulletin: IBM Security Access Manager version 9.0.3.0 appliances are affected by multiple kernel vulnerabilities

Summary IBM Security Access Manager Appliance has addressed the following kernel vulnerabilities. Vulnerability Details CVEID: CVE-2016-10229 DESCRIPTION: Linux Kernel could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in udp.c. By sending specially-crafted UD...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM Security Access Manager

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Versions 6, 7 & 8 and IBM® Runtime Environment Java™ Versions 6,7 & 8 used by IBM Security Access Manager software and appliances. These issues were disclosed as part of the IBM Java SDK updates in Jul 2017...

Security Bulletin: IBM Security Access Manager appliances are affected by vulnerabilities in libtasn1 (CVE-2015-2806, CVE-2015-3622)

Summary IBM Security Access Manager has addressed these vulnerabilities, which affect the IBM Security Access Manager appliances. Vulnerability Details CVEID: CVE-2015-3622 DESCRIPTION: GNU Libtasn1 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking by the...

Security Bulletin: IBM Security Access Manager appliances are affected by kernel vulnerabilities

Summary The IBM Security Access Manager appliance has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2016-9555 DESCRIPTION: Linux Kernel is vulnerable to a denial of service, caused by an out-of-bounds access error in sctpsfootb. By sending specially crafted data, a...

Security Bulletin: IBM Security Access Manager Appliance is affected by a cross-site request forgery vulnerability (CVE-2017-1194)

Summary IBM Security Access Manager Appliance has addressed the following cross-site request forgery vulnerability that has been identified in IBM WebSphere Application Server. Vulnerability Details CVEID: CVE-2017-1194 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site...

Security Bulletin: IBM Security Access Manager version 9.0.3.0 appliances are affected by an XML External Entity injection vulnerability (CVE-2017-1477)

Summary IBM Security Access Manager has addressed the following XML External Entity Injection vulnerability, which affects the IBM Security Access Manager version 9.0.3.0 appliance. Vulnerability Details CVEID: CVE-2017-1477 DESCRIPTION: IBM Security Access Manager Appliance is vulnerable to a XM...

Security Bulletin: IBM Security Access Manager appliances are affected by a command injection vulnerability (CVE-2017-1453)

Summary IBM Security Access Manager has addressed the following command injection vulnerability, which affects IBM Security Access Manager version 9.0.3.0 appliances. Vulnerability Details CVEID: CVE-2017-1453 DESCRIPTION: IBM Security Access Manager Appliance could allow a remote authenticated...

Security Bulletin: IBM Security Access Manager Appliance is affected by an open redirect vulnerability (CVE-2017-1534)

Summary IBM Security Access Manager Appliance has addressed the following vulnerability. Vulnerability Details CVEID: CVE-2017-1534 DESCRIPTION: IBM Security Access Manager Appliance could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim t...

Security Bulletin: IBM Security Access Manager appliances are affected by multiple Network Time Protocol (NTP) vulnerabilities

Summary IBM Security Access Manager has addressed the following vulnerabilities that have been identified in Network Time Protocol NTP. Vulnerability Details CVEID: CVE-2016-7426 DESCRIPTION: NTP is vulnerable to a denial of service, caused by the improper handling of invalid server responses. By...