Security Bulletin: IBM® Java™ SDK Technology Edition affects IBM Security Identity Manager Virtual Appliance (CVE-2020-14782, CVE-2020-14781)

Summary There are multiple vulnerabilities in IBM® Java™ SDK Technology Edition used by IBM Security Identity Manager Virtual Appliance. IBM Security Identity Manager Virtual Appliance has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified...

CVE-2021-22003: Improper Restriction of Excessive Authentication Attempts

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...

CVE-2021-22002: Improper Authentication

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

Security Bulletin: Security vulnerabilitiy has been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilitiy affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2020-1971, CVE-2020-15999, CVE-2017-12652)

Summary IBM Security Privileged Identity Manager has addressed several security issues as follows. Vulnerability Details CVEID: CVE-2020-1971 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by a NULL pointer dereference. If the GENERALNAMEcmp function contain an EDIPARTYNAME, an...

VMware Workspace One Access / VMware Identity Manager Multiple Vulnerabilities (VMSA-2021-0016)

The VMware Workspace One Access formerly VMware Identity Manager application running on the remote host is affected by the following vulnerabilities: - A security bypass vulnerability exists in due to improper validation of host headers. An unauthenticated, remote attacker can exploit this, via a...

The vulnerability of the VMware Identity Manager (vIDM), Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager lies in the transmission of data through an unprotected primary channel, allowing attackers to circumvent existing security restrictions.

The vulnerability of the VMware Identity Manager vIDM, Workspace ONE Access, Cloud Foundation, and vRealize Suite Lifecycle Manager lies in the transmission of data through an unprotected primary channel. Exploiting this vulnerability allows a malicious actor to circumvent existing security...

VulnCheck KEV: CVE-2022-22972

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate...

Vulnerabilities fixed in VMware Workspace One Access and Identity Manager

VMware has fixed vulnerabilities in Workspace One Access and Identity Manager, as used by VMware Cloud Foundation, Identity Manager, Workspace One Access and vRealize. A unauthenticated malicious party could potentially exploit them to gain access to sensitive system data. VMware has released...

PT-2021-3779

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager affected versions not specified VMware Identity Manager affected versions not specified vRealize Automation affected versions not specified Cloud Foundation affected versions not specified...

Vmware Workspace One 信息泄露漏洞

Vmware Vmware Workspace One is a platform for supporting cross-device applications for rapid delivery and management of applications from Vmware, USA. The platform, which includes VMware Horizon and VMware Horizon Cloud, integrates access control, application management, and multi-platform endpoi...

PT-2021-3778

Name of the Vulnerable Software and Affected Versions VMware Workspace ONE Access and Identity Manager affected versions not specified Description The issue is related to the unintentional provision of a login interface on port 7443, which may allow a malicious actor with network access to attemp...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2019-12450)

Summary IBM Security Privileged Identity Manager has addressed an issue for dnsmasq as follows. Vulnerability Details CVEID: CVE-2019-14834 DESCRIPTION: dnsmasq is vulnerable to a denial of service, caused by a memory leak in the createhelper function in /src/helper.c. By sending a specially...

Security Bulletin: IBM Security Privileged Identity Manager is affected by a security vulnerability

Summary IBM Security Privileged Identity Manager has addressed the following security vulnerability. Vulnerability Details CVEID: CVE-2016-3616 DESCRIPTION: cjpeg is vulnerable to a denial of service, caused by a NULL pointer dereference in the libjpeg library. By persuading a victim to open a...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2020-25684, CVE-2020-25685, CVE-2020-25686)

Summary IBM Security Privileged Identity Manager has addressed issues for dnsmasq as follows. Vulnerability Details CVEID: CVE-2020-25684 DESCRIPTION: dnsmasq is vulnerable to dns cache poisoning, caused by the failure to validate the combination of address/port and the query-id fields of DNS...

Security Bulletin: IBM Security Privileged Identity Manager is affected by security vulnerabilities (CVE-2019-12450)

Summary IBM Security Privileged Identity Manager has addressed an issue for glib2 as follows. Vulnerability Details CVEID: CVE-2019-12450 DESCRIPTION: GNOME GLib could allow a remote attacker to bypass security restrictions, caused by improper permission control in the filecopyfallback in...

Security Bulletin: IBM Security Privileged Identity Manager is affected by XML External Entity (XXE) Injection vulnerability vulnerability in WebSphere Application Server (CVE-2021-20353)

Summary IBM Security Privileged Identity Manager has addressed an XML External Entity Injection vulnerability in WebSphere application server. Vulnerability Details CVEID: CVE-2021-20353 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to an XML External Entity...

Security Bulletin: IBM Security Privileged Identity Manager is affected by vulnerability in CVE-2020-14782 (deferred from Oracle Oct 2020 CPU for Java 8)

Summary IBM Security Privileged Identity Manager has addressed a command execution vulnerability in Java SE related to the Libraries component Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in Java SE related to the Libraries component could allow an...

Security Bulletin: IBM Security Privileged Identity Manager is affected by vulnerability in IBM SDK, Java Technology Edition Quarterly CPU - Oct 2020

Summary IBM Security Privileged Identity Manager has addressed several vulnerabilities in Java SE. Vulnerability Details CVEID: CVE-2020-14779 DESCRIPTION: An unspecified vulnerability in Java SE related to the Serialization component could allow an unauthenticated attacker to cause a denial of...

Security Bulletin: IBM Security Privileged Identity Manager is affected by sensitive information exposure vulnerability in IBM Java SE (CVE-2020-14781)

Summary IBM Security Privileged Identity Manager has addressed a sensitive information exposure vulnerability in Java SE. Vulnerability Details CVEID: CVE-2020-14781 DESCRIPTION: An unspecified vulnerability in Java SE related to the JNDI component could allow an unauthenticated attacker to obtai...