CVE-2009-2583

Multiple session fixation vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0.0.6 allow remote attackers to hijack web sessions via unspecified vectors involving the 1 console and 2 self service interfaces...

CVE-2009-2583

CVE-2009-2583 describes multiple session fixation vulnerabilities in IBM Tivoli Identity Manager (ITIM) 5.0.0.6 . The issue allows remote attackers to hijack web sessions via unspecified vectors involving the console and self service interfaces . The description does not specify the exact exploit...

CVE-2009-2316

Multiple cross-site scripting XSS vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in 1 the self-service UI interface or 2 the console interface. NOTE: it was later reported that 4.6.0 is also...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in 1 the self-service UI interface or 2 the console interface. NOTE: it was later reported that 4.6.0 is also...

CVE-2009-2316

CVE-2009-2316 affects IBM Tivoli Identity Manager (ITIM) 5.0. The vulnerability is described as multiple cross-site scripting (XSS) flaws that allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in the self-service UI and the console interface; note that 4...

CVE-2009-2316

Multiple cross-site scripting XSS vulnerabilities in IBM Tivoli Identity Manager ITIM 5.0 allow remote attackers to inject arbitrary web script or HTML by entering an unspecified URL in 1 the self-service UI interface or 2 the console interface. NOTE: it was later reported that 4.6.0 is also...

Sun IDM Arbitrary Commands Execution Vulnerability

1 Summary Affected Software: Sun IDM 7.1, 8.0 Vendor URL: http://www.sun.com/ Severity: Medium 2 Description Sun Identity Manager facilitates centralized identity provisioning for variety of application and platforms. Its web interface allows end users to request password change. To handle such...

Sun Java System Identity Manager ext Parameter Arbitrary File Retrieval

The version of Sun Java System Identity Manager hosted on the remote web server fails to sanitize user-supplied input to 'ext' parameter in file 'includes/helpServer.jsp' before using it to display help files. An unauthenticated attacker can exploit this vulnerability to retrieve arbitrary files...

Sun Java System Identity Manager Account Disclosure

The version of Sun Java System Identity Manager running on the remote host has the following account enumeration vulnerabilities : - The error message for a failed login attempt is different, depending on whether or not a valid username was given. - Requesting...

POC - Sun Java System Acccess Manager & Identity Manager Users Enumeration

============================================================ Sun Java System Acccess Manager & Identity Manager Users Enumeration ============================================================ Affected Software: Sun Java System Access Server, OpenSSo Sun Java System Identity Manager Author: Marco...

Sun Java System Identity Manager / Access Manager accounts enumeration

Replies for invalid username and invalid password are different...

CVE-2009-1074

Sun Java System Identity Manager IdM 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs...

CVE-2009-1077

The Change My Password implementation in the admin interface in Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the...

CVE-2009-1078

Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the expected privilege requirements for 1 deleting audit policies and 2 modifying workflows, which allows remote authenticated users to have an unspecified impact...

CVE-2009-1082

Sun Java System Identity Manager IdM 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and...

Design/Logic Flaw

Sun Java System Identity Manager IdM 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Sun Java System Identity Manager IdM 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID 19033...

Default credentials

The Change My Password implementation in the admin interface in Sun Java System Identity Manager IdM 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the...

Design/Logic Flaw

Sun Java System Identity Manager IdM 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."...

Design/Logic Flaw

Sun Java System Identity Manager IdM 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object...