CVE-2025-36356: Execution with Unnecessary Privileges

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to escalate their privileges to root due to execution with more privileges than required...

CVE-2025-36355: Inclusion of Functionality from Untrusted Control Sphere

IBM Security Verify Access and IBM Security Verify Access Docker 10.0.0.0 through 10.0.9.0 and 11.0.0.0 through 11.0.1.0 could allow a locally authenticated user to execute malicious scripts from outside of its control sphere...

CVE-2024-35142: Execution with Unnecessary Privileges

IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. IBM X-Force ID: 292418...

PT-2024-26335

Name of the Vulnerable Software and Affected Versions IBM Security Verify Access Docker versions 10.0.0 through 10.0.6 Description The issue allows a local user to escalate their privileges due to the execution of unnecessary privileges. Recommendations For versions 10.0.0 through 10.0.6, update ...

Security Bulletin: Multiple Security Vulnerabilities were discovered in IBM Security Verify Access Container (CVE-2024-35140, CVE-2024-35141, CVE-2024-35142)

Summary Vulneribities were discovered during an assessment of the IBM Security Verify Access Container Product. They were addressed in the ISVA 10.0.7 release. Vulnerability Details CVEID:CVE-2024-35142 DESCRIPTION: IBM Security Verify Access could allow a local user to escalate their privileges...

CVE-2023-32329: Insufficient Verification of Data Authenticity

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a user to download files from an incorrect repository due to improper file validation. IBM X-Force ID: 254972...

CVE-2023-43016: Empty Password in Configuration File

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1 could allow a remote user to log into the server due to a user account with an empty password. IBM X-Force ID: 266154...

CVE-2023-31001 IBM Security Access Manager Container information disclosure

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653...

CVE-2023-31003: Improper Link Resolution Before File Access

IBM Security Access Manager Container IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658...

CVE-2023-38267: Missing Encryption of Sensitive Data

IBM Security Access Manager Appliance IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584...

Security Bulletin: IBM Security Verify Access fixed a security vulnerability in the product.

Summary IBM Security Verify Access with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. Vulnerability Details CVEID: CVE-2021-39070 DESCRIPTION: IBM Security Verify Access with the advanced access control authentication...

CVE-2021-20537

IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID:198918...

PT-2021-14024

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Docker version 10.0.0 Description: A remote attacker could conduct phishing attacks using an open redirect attack. The attacker could persuade a victim to visit a specially crafted Web site, exploiting this issue to...

PT-2021-13995

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Docker version 10.0.0 Description: The issue allows an authenticated user to bypass input due to improper input validation. Recommendations: For IBM Security Verify Access Docker version 10.0.0, consider restricting...

CVE-2021-20498: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972...

CVE-2021-20523: Generation of Error Message Containing Sensitive Information

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660...

CVE-2021-20439: Insufficiently Protected Credentials

IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user...

CVE-2021-20500: Undefined Security Weakness

IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980...

CVE-2021-20497: Use of a Broken or Risky Cryptographic Algorithm

IBM Security Verify Access Docker 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 197969...

PT-2021-14010

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access Docker version 10.0.0 Description: The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing dot dot sequences /../ to view arbitrary files on the...