CVE-2016-5959

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 116136...

CVE-2016-5959

CVE-2016-5959 affects IBM Security Privileged Identity Manager (ISPIM) versions 2.0.2 and 2.1.0. The root cause is that the product stores sensitive information in URL parameters, creating a risk of information disclosure if URLs are captured in server logs, the referrer header, or browser histor...

CVE-2016-5960

CVE-2016-5960 affects IBM Security Privileged Identity Manager (ISPIM) 2.0.2 and 2.1.0. The flaw is that user credentials are stored in plain text, readable by a local attacker (information disclosure; local access required). Remediation is available: ISPIM fixes 2.0.2-ISS-ISPIM-VA-IF0010 and 2.1...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-09514)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

IBM Security Privileged Identity Manager Information Disclosure Vulnerability (CNVD-2017-09515)

IBM Security Privileged Identity Manager ISPIM is an identity management product within IBM Identity Governance and Management, an identity governance solution from IBM Corporation, USA, that protects, automates and audits the use of privileged identities,... It is designed to protect, automate a...

PT-2017-8833

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager versions 2.0.2 through 2.1.0 Description The issue concerns the storage of sensitive information in URL parameters, which could lead to information disclosure if unauthorized parties gain access to the...

CVE-2016-5959: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 116136...

CVE-2016-5960: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Privileged Identity Manager 2.0.2 and 2.1.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 116171...

PT-2017-8834

Name of the Vulnerable Software and Affected Versions IBM Security Privileged Identity Manager versions 2.0.2 through 2.1.0 Description The issue allows a local user to read user credentials stored in plain text. Recommendations For versions 2.0.2 and 2.1.0, update to a version that does not stor...

IBM Tivoli Federated Identity Manager Information Disclosure Vulnerability

IBM Tivoli Federated Identity Manager TFIM is a cross-enterprise federated identity management product from IBM, USA. The product provides Web and federated single sign-on capabilities SSO to users using multiple applications. An information disclosure vulnerability exists in IBM TFIM versions...

IBM Tivoli Federated Identity Manager 6.2.x < 6.2.2 FP17 Multiple Vulnerabilities

The version of IBM Tivoli Federated Identity Manager installed on the remote Windows host is 6.2.x prior to 6.2.2.17. It is, therefore, affected by multiple vulnerabilities : - An information disclosure vulnerability exists due to a failure to properly use Secure attributes in cookies. An...

IBM Tivoli Federated Identity Manager Cross-Site Scripting Vulnerability (CNVD-2017-09951)

IBM Tivoli Federated Identity Manager is a cross-enterprise federated identity management product from IBM USA. A cross-site scripting vulnerability in IBM Tivoli Federated Identity Manager allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be...

CVE-2017-1320

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

CVE-2017-1320

IBM Tivoli Federated Identity Manager 6.2.x is affected by CVE-2017-1320 (XSS in Web UI) per IBM/SWG bulletin. Affected versions include 6.2.0, 6.2.1, and 6.2.2.x (up to 6.2.2.17). Remediation is to apply patch 6.2.2-FP0017 or upgrade to 6.2.2.17, per IBM’s remediation table. CVSS v3.0 vector (AV...

PT-2017-12960

Name of the Vulnerable Software and Affected Versions IBM Tivoli Federated Identity Manager version 6.2 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted...

CVE-2017-1320: Improper Neutralization of Input During Web Page Generation

IBM Tivoli Federated Identity Manager 6.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 125732...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

Buffer overflow

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2017-3553

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware subcomponent: Rules Engine. The supported version that is affected is 11.1.2.3.0. Easily "exploitable" vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager...