CVE-2017-1366

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

CVE-2017-1412

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400...

Information disclosure

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396...

CVE-2017-1366

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

Authorization

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

CVE-2017-1411

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399...

CVE-2017-1755

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files that could be executed by the administrator. IBM X-Force ID: 135855...

CVE-2017-1368

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie...

CVE-2017-1412

CVE-2017-1412 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2, 5.2.1, 5.2.2, 5.2.2.1, 5.2.3, 5.2.3.1, 5.2.3.2. Description in the IBM bulletin confirms that the vulnerability arises from an error message that exposes sensitive information about the e...

CVE-2017-1755

The CVE-2017-1755 entry affects IBM Security Identity Governance Virtual Appliance versions 5.2 through 5.2.3.2. The connected IBM bulletin confirms a local vulnerability whereby an attacker could inject commands into malicious files that could be executed by an administrator, indicating a local ...

CVE-2017-1409

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396...

CVE-2017-1366

CVE-2017-1366 affects IBM Security Identity Governance Virtual Appliance (IGI) 5.2 through 5.2.3.2, where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. The issue is tied to IGI’s deployment and crypto handling, with IBM noting a rem...

CVE-2017-1396

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 127342...

CVE-2017-1368

CVE-2017-1368 affects IBM Security Identity Governance Virtual Appliance 5.2–5.2.3.2, where authorization tokens and session cookies are not marked Secure. This allows cookie values to be exposed when users click http:// links or visit sites that load the links, enabling cookie snooping. Root cau...

CVE-2017-1412

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400...

CVE-2017-1409

Technical details about CVE-2017-1409 (IBM Security Identity Governance Virtual Appliance information disclosure) are not present in the provided connected documents. Public information here confirms the issue but does not specify affected components, root cause, exploit details, or fixes. Monito...

CVE-2017-1366

IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 126859...

CVE-2017-1396

The CVE-2017-1396 issue affects IBM Security Identity Governance Virtual Appliance (IGI) versions 5.2 through 5.2.3.2, where permissions on a security-critical resource could allow read/modify by unintended actors. Affected IGI releases include 5.2, 5.2.1, 5.2.2, 5.2.2.1, 5.2.3, 5.2.3.1, and 5.2....

CVE-2017-1411

CVE-2017-1411 affects IBM Security Identity Governance Virtual Appliance (IGI) versions 5.2 through 5.2.3.2. The vulnerability description indicates that, by default, users are not required to use strong passwords, enabling potential account compromise. The Connected documents confirm IGI family ...

Security Bulletin: IBM has announced a release for IBM Security Identity Governance and Intelligence in response to multiple security vulnerabilities

Summary IBM has announced a release for IBM Security Identity Governance and Intelligence IGI in response to multiple security vulnerabilities. There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 8 and IBM® Runtime Environment Java™ Version 8 included in this release ...