The vulnerability of the IBM Security Identity Manager software lies in the lack of measures to sanitize input data, allowing a perpetrator to execute arbitrary code.

The vulnerability of the IBM Security Identity Manager software is related to the lack of measures for cleaning input data. Exploiting this vulnerability could allow a malicious actor operating remotely to execute arbitrary code...

Security Bulletin: A security vulnerability was identified in WebSphere Application Server as shipped with IBM Tivoli Federated Identity Manager (CVE-2019-4670)

Summary WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security bulletin affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixe...

CVE-2019-4675

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511...

CVE-2019-4675

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511...

CVE-2019-4451

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

CVE-2019-4451

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

CVE-2019-4674

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

Design/Logic Flaw

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

Cross site scripting

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

Hardcoded credentials

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511...

CVE-2019-4674

IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 171510...

CVE-2019-4674

CVE-2019-4674 affects IBM Security Identity Manager 7.0.1, where a remote attacker could traverse directories by sending a URL with dot-dot (../) sequences to view arbitrary files. The vulnerability is a directory traversal in ISIM, enabling partial confidentiality impact. IBM’s related advisory ...

CVE-2019-4675

IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 171511...

CVE-2019-4675

CVE-2019-4675 affects IBM Security Identity Manager 7.0.1, where the component contains hard-coded credentials used for its own inbound authentication, outbound communication to external components, or encryption of internal data. The root cause is the presence of embedded credentials in ISIM ver...

CVE-2019-4451

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

CVE-2019-4451

IBM Security Identity Manager (ISIM) 6.0.0 is affected by CVE-2019-4451, a cross-site scripting vulnerability in the Web UI that could lead to credentials disclosure within a trusted session. The IBM Security bulletin confirms the vulnerability and lists the affected product/version. Remediation ...

PT-2020-11018

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager version 7.0.1 Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used by IBM Security Identity Manager for inbound authentication, outbound communication to external...

CVE-2019-4451: Improper Neutralization of Input During Web Page Generation

IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493...

PT-2020-10953

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager version 6.0.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2020-11017

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager version 7.0.1 Description The issue allows a remote attacker to traverse directories on the system. This can be achieved by sending a specially-crafted URL request containing dot dot sequences /../ to view arbitra...