CVE-2021-22056

CVE-2021-22056 is an SSRF vulnerability affecting VMware Workspace ONE Access (versions 21.08, 20.10.0.1, 20.10) and VMware Identity Manager (3.3.5, 3.3.4, 3.3.3). A malicious actor with network access could make HTTP requests to arbitrary origins and read the full response. Red Hat and CVE recor...

Vulnerabilities fixed in VMware products

VMware has fixed vulnerabilities in the following products: VMware Cloud Foundation VMware Identity Manager vIDM VMware Workspace ONE Access Access VMware vRealize Automation vRA VMware vRealize Suite Lifecycle Manager A remote malicious party could potentially exploit them to bypass two-factor...

Vmware Workspace One Access 代码问题漏洞

Vmware Workspace One Access is Vmware's combination of user identity with factors such as device and network information to make intelligence-driven conditional access decisions for Workspace One-delivered applications. A code issue vulnerability exists in VMware Workspace ONE Access versions...

Security Bulletin: IBM Security Privileged Identity Manager NOT Affected by CVE-2021-44228 Exploit

Summary IBM Security Privileged Identity Manager NOT Affected by CVE-2021-44228 Exploit. Vulnerability Details After conducting extensive research on product code base, it is determined that all versions of IBM Security Privileged Identity Manager are not vulnerable to Java library Apache log4j v...

VMSA-2021-0030:VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities

Advisory ID: VMSA-2021-0030 CVSSv3 Range: 5.5-6.6 Issue Date:2021-12-17 Updated On: 2021-12-17 Initial Advisory CVEs: CVE-2021-22056, CVE-2021-22057 Synopsis: VMware Workspace ONE Access, Identity Manager and vRealize Automation updates address multiple vulnerabilities CVE-2021-22056,...

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Cloud Proxy VMware vRealize Automation VMware vRealize...

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Cloud Proxy VMware vRealize Automation VMware vRealize...

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Cloud Proxy VMware vRealize Automation VMware vRealize...

VMware Response to Apache Log4j Remote Code Execution Vulnerabilities (CVE-2021-44228, CVE-2021-45046)

1. Impacted Products Under Evaluation VMware Horizon VMware vCenter Server VMware HCX VMware NSX-T Data Center VMware Unified Access Gateway VMware WorkspaceOne Access VMware Identity Manager VMware vRealize Operations VMware vRealize Operations Cloud Proxy VMware vRealize Automation VMware...

The vulnerability of the Password Synchronization Plug-in of the IBM Security Identity Manager allows a perpetrator to modify the passwords of other users.

The vulnerability of the Password Synchronization Plug-in of the IBM Security Identity Manager relates to deficiencies in the segmentation of the controlled system area. Exploiting this vulnerability could allow an intruder operating remotely to gain unauthorized access to protected information...

The vulnerability of the IBM Security Identity Manager software, related to insufficient validation of incoming requests, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the IBM Security Identity Manager software is related to insufficient validation of incoming requests. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through specially crafted requests...

Multiple VMware Products Command Injection Vulnerability

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a command injection vulnerability. An attacker with network access to the administrative configurator on port 8443 and a valid password for the configurator administrator account can execute...

Security Bulletin: A Security Vulnerabililty has been identified in IBM HTTP Server used by WebSphere Application Server shipped with IBM Tivoli Federated Identity Manager

Summary IBM HTTP Server used by WebSphere Application Server is shipped with IBM Tivoli Federated Identity Manager. Information about a security vulnerability affecting IBM HTTP Server used by WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to t...

Security Bulletin: Multiple vulnerabilities have been identified in IBM SDK, Java Technology Edition shipped with IBM Tivoli Federated Identity Manager

Summary IBM SDK, Java Technology Edition is shipped with IBM Tivoli Federated Identity Manager. Information about security vulnerabilities affecting IIBM SDK, Java Technology Edition has been published in a security bulletin Vulnerability Details Refer to the security bulletins listed in the...

'/;/WEB-INF/' Information Disclosure Vulnerability (HTTP)

Various application or web servers / products are prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Security Bulletin:Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Verify Governance, Identity Manager software component

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Verify Governance, Identity Manager Software component SVG IMSW. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer t...

Security Bulletin:Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Security vulnerabilities have been identified in IBM WebSphere Application Server shipped with IBM Security Verify Governance, Identity Manager software component

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Verify Governance, Identity Manager softtware component. Information about security vulnerabilities affecting IBM WebSphere Application Server have been published in a security bulletin. Vulnerability Details Refer to the...

Security Bulletin: Security vulnerability has been identified in IBM WebSphere Application Server shipped with IBM Security Identity Manager

Summary IBM WebSphere Application Server WAS is shipped with IBM Security Identity Manager ISIM. Information about security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: Multiple security vulnerabilities have been fixed in IBM Security Verify Governance, Identity Manager virtual appliance component (ISVG IMVA)

Summary IBM Security Verify Governance, Identity Manager virtual appliance component has addressed the following vulnerabilities. Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service, caused by the failure to apply a configured connection...