CVE-2016-6027

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP...

CVE-2016-6027

CVE-2016-6027 affects IBM Sterling Secure Proxy Configuration Manager (SSP CM). The issue is that HSTS protection was not enabled in SSP Configuration Manager, making it possible for an attacker to obtain sensitive information or modify data by exploiting HTTP instead of HTTPS. Affected versions ...

CVE-2016-6025

CVE-2016-6025 affects IBM Sterling Secure Proxy (SSP) Configuration Manager. The issue occurs in SSP versions 3.4.2 before iFix 8 and 3.4.3 before iFix 1, where a post-logoff session-reuse attack via a modified URL could allow remote attackers to obtain access. The vulnerability is tied to the Co...

CVE-2016-6026

The CVE-2016-6026 issue affects IBM Sterling Secure Proxy Configuration Manager in SSP, specifically the Configuration Manager component. Affected versions are IBM Sterling Secure Proxy 3.4.3 GA and 3.4.2 through 3.4.2.0 with iFix levels (3.4.3.0 iFix 1; 3.4.2.0 iFix 7). The vulnerability allows ...

CVE-2016-6025: Undefined Security Weakness

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to obtain access by leveraging an unattended workstation to conduct a post-logoff session-reuse attack involving a modified URL...

CVE-2016-6026: Exposure of Sensitive Information to an Unauthorized Actor

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows man-in-the-middle attackers to obtain sensitive information via an HTTP method that is neither GET nor POST...

CVE-2016-6027: Improper Neutralization of Input During Web Page Generation

The Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 does not enable the HSTS protection mechanism, which makes it easier for remote attackers to obtain sensitive information or modify data by leveraging use of HTTP...

CVE-2016-6023: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy SSP 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL...

PT-2016-6755

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy SSP versions 3.4.2 through 3.4.2.0 iFix 7 IBM Sterling Secure Proxy SSP versions 3.4.3 through 3.4.3.0 iFix 0 Description A directory traversal issue in the Configuration Manager of IBM Sterling Secure Proxy allows...

PT-2016-6756

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy SSP versions 3.4.2 through 3.4.2.0 iFix 7 IBM Sterling Secure Proxy SSP versions 3.4.3 through 3.4.3.0 iFix 0 Description The issue allows remote attackers to obtain access by leveraging an unattended workstation to...

PT-2016-6757

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy SSP versions 3.4.2 through 3.4.2.0 iFix 7 IBM Sterling Secure Proxy SSP versions 3.4.3 through 3.4.3.0 iFix 0 Description The issue in the Configuration Manager of IBM Sterling Secure Proxy allows man-in-the-middle...

PT-2016-6758

Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy SSP versions 3.4.2 through 3.4.2.0 iFix 7 IBM Sterling Secure Proxy SSP versions 3.4.3 through 3.4.3.0 iFix 0 Description The issue concerns the Configuration Manager in IBM Sterling Secure Proxy SSP which does not...

Google Adds Content Security Policy Support to Gmail

Google has added another layer of security for users of Gmail on the desktop, which now supports content security policy, a standard that’s designed to help mitigate cross-site scripting and other common Web-based attacks. CSP is a W3C standard that has been around for several years, and it’s bee...

CVE-2013-0515: IBM Sterling Secure Proxy insecure cookie

IBM Sterling Secure Proxy CVE-2013-0515 concerns session/sensitive cookies not always receiving the Secure attribute, allowing potential cookie hijacking on HTTP. Affected releases include Sterling Secure Proxy 3.4.1, 3.4.0, 3.3.01, and 3.2.0. Remediation per IBM is to apply the following fixes: ...

CVE-2013-0518

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

Information disclosure

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in 1 an unspecified page title and 2 an unspecified HTTP header field, which allows remote attackers to obtain potentially...

Code injection

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2013-0519

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in 1 an unspecified page title and 2 an unspecified HTTP header field, which allows remote attackers to obtain potentially...

CVE-2013-0520

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java stack-trace information by providing invalid input data...

CVE-2013-0518

IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site...