CVE-2024-2227 IdentityIQ JavaServer Faces File Path Traversal Vulnerability

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces JSF 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the...

PT-2024-19297

Name of the Vulnerable Software and Affected Versions SailPoint IdentityIQ affected versions not specified Description The issue is a path traversal vulnerability in JavaServer Faces JSF that allows access to arbitrary files in the application server file system. This can be exploited by an...

CVE-2024-1714

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request...

CVE-2024-1714

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request...

Cross site request forgery (csrf)

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request...

CVE-2024-1714

CVE-2024-1714 affects IdentityIQ Lifecycle Manager. The issue is that an entitlement value containing leading or trailing whitespace can be requested by an authenticated user in an access request, impacting all supported versions. The provided connected sources describe the vulnerability but do n...

CVE-2024-1714 Access Request for Entitlement Values with Leading/Trailing Whitespace

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request...

CVE-2024-1714 Access Request for Entitlement Values with Leading/Trailing Whitespace

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request...

SailPoint IdentityIQ Security Vulnerability

SailPoint IdentityIQ is a security software from SailPoint, Inc. which provides credit monitoring, identity insurance, and antivirus. A security vulnerability exists in SailPoint IdentityIQ Lifecycle Manager that stems from improperly limiting parameter values...

PT-2024-18245 · Sailpoint · Identityiq Lifecycle Manager

Name of the Vulnerable Software and Affected Versions: IdentityIQ Lifecycle Manager affected versions not specified Description: An issue exists in IdentityIQ Lifecycle Manager where an entitlement with a value containing leading or trailing whitespace can be requested by an authenticated user in...

CVE-2023-32217

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

CVE-2023-32217

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

CVE-2023-32217

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

Design/Logic Flaw

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

Vulnerability fixed in Sailpoint IdentityIQ

Sailpoint has fixed a vulnerability in IdentityIQ. A authenticated malicious person could exploit the vulnerability to execute arbitrary code in the application, potentially gain access to user credentials and authorization information. Sailpoint has released updates to fix the vulnerability in a...

IdentityIQ 安全漏洞

IdentityIQ is a security software from IdentityIQ, Inc. which provides credit monitoring, identity insurance, and antivirus. IdentityIQ suffers from a security vulnerability that stems from allowing an authenticated user to call a Java constructor without parameters or a Java constructor with a...

CVE-2023-32217

CVE-2023-32217 affects SailPoint IdentityIQ versions 8.0 through 8.3 (with patches up to 8.0p6, 8.1p7, 8.2p6, 8.3p3 respectively). The issue stems from unsafe use of reflection that allows an authenticated user to invoke a Java constructor with no arguments or a single Map argument in any Java cl...

PT-2023-23663 · Sailpoint · Identityiq

Name of the Vulnerable Software and Affected Versions: IdentityIQ versions 8.0 through 8.0p5 IdentityIQ versions 8.1 through 8.1p6 IdentityIQ versions 8.2 through 8.2p5 IdentityIQ versions 8.3 through 8.3p2 Description: The issue allows an authenticated user to invoke a Java constructor with no...

CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...

CVE-2023-32217 SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments...