CVE-2009-5085

CVE-2009-5085 affects IBM Tivoli Federated Identity Manager (TFIM) version 6.2.0 prior to 6.2.0.2 when configured as an OpenID provider. The issue arises because TFIM does not delete the site information cookie after a user deletes a relying-party trust entry, enabling user-assisted remote attack...

CVE-2011-3135

Technical details for CVE-2011-3135 are not publicly provided in the connected documents. The initial description notes unspecified impact and attack vectors, but no concrete affected products, versions, root causes, or fixes are documented here. Monitor for updates.

CVE-2009-5083

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...

CVE-2009-5083

CVE-2009-5083 affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 prior to 6.2.0.2 when configured as an OpenID relying party. The underlying issue is that the component does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, allowing a remote...

CVE-2009-5084

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data...

CVE-2011-3136

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048...

CVE-2009-5083: Improper Authentication

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors...

CVE-2008-7299: Improper Input Validation

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2 uses an incomplete SAML 1.x browser-artifact, which allows remote OpenID providers to spoof assertions via vectors related to the Issuer field...

CVE-2011-3136: Undefined Security Weakness

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048...

CVE-2011-3137: Undefined Security Weakness

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050...

CVE-2009-5084: Undefined Security Weakness

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data...

CVE-2011-3135: Undefined Security Weakness

Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors...

CVE-2009-5085: Undefined Security Weakness

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...

CVE-2011-3138: Undefined Security Weakness

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

CVE-2010-4324

Cross-site scripting XSS vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager aka IDM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-4324

CVE-2010-4324 concerns a Cross-site scripting (XSS) vulnerability in the Approval Form of the User Application in the Roles Based Provisioning Module of Novell Identity Manager. Affected software is IDM with RBPM module version 3.7.0 before 370D. The vulnerability allows remote attackers to injec...

CVE-2010-4324

Cross-site scripting XSS vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager aka IDM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-4324: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Approval Form in the User Application in the Roles Based Provisioning Module 3.7.0 before 370D in Novell Identity Manager aka IDM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2010-3546

Unspecified vulnerability in the Sun Java System Identity Manager component in Oracle Sun Products Suite 8.1 allows remote attackers to affect confidentiality and integrity via unknown vectors...

Design/Logic Flaw

Unspecified vulnerability in the Sun Java System Identity Manager component in Oracle Sun Products Suite 8.1 allows remote attackers to affect confidentiality and integrity via unknown vectors...