Code injection

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

Session fixation

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session...

CVE-2014-6095

Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified vectors...

Cross site request forgery (csrf)

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request...

CVE-2014-6110

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sessions by leveraging an unattended workstation...

CVE-2014-6096

Cross-site scripting XSS vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-6105

IBM Security Identity Manager (SIM) 6.x prior to 6.0.0.3 IF14 is affected by a clickjacking vulnerability. A remote attacker could hijack the victim’s clicking actions by persuading them to visit a malicious page; no authentication is required. Impact is limited to the client-side click actions, ...

CVE-2014-6107

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session...

CVE-2014-6098

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request...

CVE-2014-6098

IBM Security Identity Manager 6.x prior to 6.0.0.3 IF14 is affected by CVE-2014-6098, where a crafted request to the web server can cause disclosure of cleartext passwords. Affected product and version: SIM 6.x before 6.0.0.3 IF14. Impact described: partial confidentiality loss via remote access ...

CVE-2014-6105

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2014-6107

IBM Security Identity Manager 6.x before 6.0.0.3 IF14 is vulnerable to leaking sensitive cookies over HTTP due to credential/cookie exposure when sniffed on the network. The issue affects SIM components and can expose partial confidentiality. Mitigation: upgrade to IBM SIM 6.0.0.3 with the accomp...

CVE-2014-6095

Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified vectors...

CVE-2014-6110

CVE-2014-6110: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 improperly logs out prior users, enabling a local attacker to bypass security and access another user’s SIM session. Affected product: IBM Security Identity Manager 6.x (component: SIM). Root cause: logout handling flaw. Impact:...

CVE-2014-6096

IBM Security Identity Manager 6.x is vulnerable to cross-site scripting (XSS) via crafted URLs, due to improper input validation. Affected: SIM 6.0 family up to 6.0.0.3 (IF14). Impact per publicly cited sources indicates potential for script execution in a victim’s browser within the site’s conte...

CVE-2014-6095

CVE-2014-6095 affects IBM Security Identity Manager 6.x prior to 6.0.0.3 IF14. It is a directory traversal vulnerability that could allow a remote attacker to read arbitrary files via unspecified vectors. The NVD lists a base score of 5.0 (Medium) with network access, low attack complexity, and p...

Oracle Identity Manager (October 2014 CPU

The remote host is missing the October 2014 Critical Patch Update for Oracle Identity Manager. It is, therefore, affected by multiple vulnerabilities : - The application is affected by a vulnerability in Apache Commons BeanUtils in which ClassLoader objects can be set via the class attribute of a...

CVE-2014-6487

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote authenticated users to affect integrity via unknown vectors related to End User Self Service...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote authenticated users to affect integrity via unknown vectors related to End User Self Service...

CVE-2014-6487

CVE-2014-6487 is an unspecified vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware versions 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2. The flaw is described as allowing remote authenticated users to affect integrity via unknown vectors related to End User Self Ser...