CVE-2018-1944

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM...

CVE-2018-1949

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...

Design/Logic Flaw

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430...

CVE-2018-1950

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430...

Information disclosure

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...

CVE-2018-1945

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click...

CVE-2018-1949

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...

CVE-2018-1944

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM...

CVE-2018-1947

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

CVE-2018-1945

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click...

CVE-2018-1948

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes...

CVE-2018-1946

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the...

CVE-2018-1950

The CVE affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2–5.2.4.1. The disclosed vulnerability is an information disclosure: an error message reveals sensitive details about the environment, users, or related data, which could aid further attacks. Root...

CVE-2018-1947

CVE-2018-1947 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2–5.2.4.1. The Web UI is vulnerable to cross-site scripting, enabling an attacker to embed arbitrary JavaScript in the UI and potentially disclose credentials within a trusted session. Root ...

CVE-2018-1944

Summary: CVE-2018-1944 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance, specifically versions 5.2 through 5.2.4.1. The root cause is hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication to external compo...

CVE-2018-1948

CVE-2018-1948 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance 5.2.x. The vulnerability is that authorization tokens and session cookies are not marked Secure, allowing cookies to be sent over HTTP. An attacker could exploit this by enticing a user to click an HTT...

CVE-2018-1946

CVE-2018-1946 involves IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2 through 5.2.4.1. The issue is not a bug in code execution but a design/crypto negotiation flaw: multiple actors can negotiate which protection algorithms (e.g., encryption/authentication)...

CVE-2018-1950

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430...

CVE-2018-1949

The CVE-2018-1949 entry affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance, specifically IGI versions 5.2 through 5.2.4.1. The vulnerability is an information disclosure issue where sensitive data may be exposed to unauthorized users, enabling further attacks on the...

CVE-2018-1945

CVE-2018-1945 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance 5.2–5.2.4.1. The vulnerability lets a remote attacker hijack a victim’s click actions by luring them to a malicious website, potentially enabling further attacks. Remediation is available: upgrade IGI ...