Security Bulletin: IBM® Java™ SDK Technology Edition affects IBM Security Verify Governance, Identity Manager virtual appliance component (ISVG IMVA) (CVE-2020-14781,CVE-2020-14782)

Summary There are multiple vulnerabilities in IBM® Java™ SDK Technology Edition, used by IBM Security Verify Governance, Identity Manager virtual appliance component which has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-14782 DESCRIPTION: An unspecified vulnerability in...

Security Bulletin: IBM Security Privileged Identity Manager is affected by WebSphere Application Server is vulnerable to a directory traversal vulnerability

Summary IBM Security Privileged Identity Manager has addressed a WebSphere Application Server is vulnerable to a directory traversal vulnerability. Vulnerability Details CVEID: CVE-2021-20354 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, and 9.0 could allow a remote attacker to traverse...

Security Bulletin: IBM Security Privileged Identity Manager is affected by CVE-2020-2773 (deferred from Oracle Apr 2020 CPU)

Summary IBM Security Privileged Identity Manager has addressed aCVE-2020-2773 deferred from Oracle Apr 2020 CPU Vulnerability Details CVEID: CVE-2020-2773 DESCRIPTION: An unspecified vulnerability in Java SE related to the Java SE Security component could allow an unauthenticated attacker to caus...

Security Bulletin: IBM Security Privileged Identity Manager is affected by WebSphere Application Server is vulnerable to a directory traversal vulnerability

Summary IBM Security Privileged Identity Manager has addressed a WebSphere Application Server is vulnerable to a Directory Traversal vulnerability. Vulnerability Details CVEID: CVE-2020-5016 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to...

Security Bulletin: Security vulnerabilitiy has been fixed in IBM Security Identity Manager (CVE-2021-29692)

Summary Security vulnerability has been fixed in IBM Security Identity Manager Vulnerability Details CVEID: CVE-2021-29692 DESCRIPTION: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport...

Security Bulletin: A security vulnerability has been fixed in IBM Security Identity Manager Virtual Appliance (CVE-2018-15494)

Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerability due to remote attcker's ability to exploit this vulnerability. Vulnerability Details CVEID: CVE-2018-15494 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting, caused by improper...

Security Bulletin: Security vulnerabilitiy has been fixed in IBM Security Identity Manager (93519)

Summary Security vulnerability has been fixed in IBM Security Identity Manager Vulnerability Details Third Party Entry: 93519 DESCRIPTION: Castor Library could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection XXE error when processing XML data. B...

Security Bulletin: IBM Security Identity Manager deprecated Self Service UI contains Struts V1 (CVE-2016-1182)

Summary IBM Security Identity Manager made code changes to remove the deprecated function and its related Struts V1 code library. Vulnerability Details CVEID: CVE-2016-1182 DESCRIPTION: Apache Struts could allow a remote attacker to bypass security restrictions, caused by the failure to properly...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Identity Manager (CVE-2021-29687, CVE-2021-29688)

Summary Security vulnerability has been fixed in IBM Security Identity Manager 6.0.2 Vulnerability Details CVEID: CVE-2021-29687 DESCRIPTION: IBM Security Identity Manager could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts. CVSS...

Security Bulletin: IBM Security Identity Manager Password Synchronization Plug-in for Windows AD affected by multiple vulnerabilities (CVE-2021-20483, CVE-2021-20488)

Summary IBM has announced a release for IBM Security Identity Manager Password Synchronization Plug-in for Windows AD to address several security vulnerabilities. The vulnerabilities concern server side request forgery and account take over. Vulnerability Details CVEID: CVE-2021-20483 DESCRIPTION...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Identity Manager Virtual Appliance

Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerabilities in Apache HttpComponents and HttpCommons that affect WebSphere Application Server Vulnerability Details CVEID: CVE-2015-5262 DESCRIPTION: Apache Commons is vulnerable to a denial of service...

CVE-2021-22002

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

CVE-2021-22002

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

CVE-2021-22003

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...

CVE-2021-22003

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...

Authentication flaw

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

Default credentials

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...

Security Bulletin: A security vulnerability has been fixed in IBM Security Identity Manager Virtual Appliance(CVE-2021-20480)

Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerability due to a remote authenticated attacker could exploit this vulnerability to obtain sensitive data. Vulnerability Details CVEID: CVE-2021-20480 DESCRIPTION: IBM WebSphere Application Server 7.0...

Security Bulletin: Security vulnerabilities have been fixed in IBM Security Identity Manager Virtual Appliance

Summary IBM Security Identity Manager Virtual Appliance ISIM VA has addressed the following vulnerabilities Vulnerability Details CVEID: CVE-2021-29682 DESCRIPTION: IBM Security Identity Manager could allow a remote attacker to obtain sensitive information when a detailed technical error message ...

CVE-2021-22003

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. A malicious actor with network access to port 7443 may attempt user enumeration or brute force the login endpoint, which may or may not be practical based on lockout policy configuration and...