CVE-2016-5990: Improper Access Control

IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the server...

CVE-2016-3021: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request...

CVE-2016-3024: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system...

PT-2017-8314

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web affected versions not specified Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the UR...

CVE-2016-5966: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle...

PT-2017-8877

Name of the Vulnerable Software and Affected Versions IBM Security Guardium Database Activity Monitor appliance affected versions not specified Description A local user could inject commands that would be executed as root, potentially allowing for elevated privileges and unauthorized system...

PT-2017-8301

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web affected versions not specified Description The issue allows an authenticated user to gain access to highly sensitive information due to incorrect file permissions. Recommendations At the moment, there is no...

PT-2017-8832

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager affected versions not specified Description The issue is caused by the failure to set the secure flag for the session cookie in SSL mode, allowing a remote attacker to obtain sensitive information by...

PT-2017-8842

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager Virtual Appliance affected versions not specified Description The issue allows an authenticated user to upload malicious files that would be automatically executed by the server. Recommendations At the...

CVE-2016-9739: Undefined Security Weakness

IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user...

CVE-2016-9703: Session Fixation

IBM Security Identity Manager Virtual Appliance does not invalidate session tokens which could allow an unauthorized user with physical access to the work station to obtain sensitive information...

PT-2017-8305

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web affected versions not specified Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions fro...

PT-2017-8303

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web affected versions not specified Description The issue allows web pages to be stored locally, which can then be accessed by another user on the system, potentially leading to unauthorized data access...

PT-2017-10278

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager Virtual Appliance affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

PT-2017-8836

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager Virtual Appliance affected versions not specified Description The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive...

CVE-2016-5964: Improper Access Control

IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials...

CVE-2016-3018: Improper Neutralization of Input During Web Page Generation

IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2016-3043: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques...

CVE-2016-5958: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture...

PT-2017-8315

Name of the Vulnerable Software and Affected Versions IBM Security Access Manager for Web affected versions not specified Description The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view information in the back-end database. This is due to...