IBM-Security-Verify-oAuth_Token_Steal-CVE-2024-35133

IBM Security Verify Access - OAuth 流程中的开放重定向 CVE-2024-35133 目录 1. 概述 2. 详细描述 3. 概念验证 4. 解决方案 5. 披露时间线 6. 参考资料 7. 致谢 8. 法律声明 概述 版本 : 1.0 影响 : 远程攻击者可通过诱使受害者访问特制网站，利用此漏洞伪造显示 URL 并将用户重定向至恶意网站。这可能导致攻击者获取高度敏感信息或对受害者发起进一步攻击。 严重性 : NIST：高危 IBM：中危 CVSS 评分 : NIST：8.2...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy contains a parameter injection flaw (CWE-74 ) that allows unauthenticated, network-based attackers to inject parameters into requests forwarded to third-party services. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium) with high attack co...

EUVD-2026-78888

IBM Security Verify Identity Access Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11929

IBM Security Verify Identity Access Reverse Proxy (also listed as affected: IBM Security Verify Access ) in certain configurations may provide weaker than expected cryptographic validation of user-supplied data. This results in a CVSS 3.1 score of 7.5 (HIGH) with a high confidentiality impact and...

CVE-2026-13276

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001...

CVE-2026-13260

IBM Verify Identity Access and IBM Security Verify Access are affected by a remote denial of service vulnerability caused by insufficient validation of incoming request resources . A remote, unauthenticated attacker over the network with low complexity can trigger the DoS, as reflected in the CVS...

CVE-2026-13276 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001...

CVE-2026-13276

IBM Verify Identity Access and IBM Security Verify Access (including their Container variants) are affected across version ranges 10.0.0–10.0.9.2 IF 001 and 11.0.0–11.0.3 IF 001. The vulnerability is rated CVSS 6.1 (Medium) with a network attack vector, low complexity, no privileges required, but...

CVE-2026-13297

IBM Verify Identity Access and IBM Security Verify Access contain an information disclosure vulnerability in the Advanced Access Control component. The flaw can be exploited over the network with low complexity, requires no prior authentication, and results in a high impact to confidentiality wit...

CVE-2026-17616

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-11932

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

CVE-2026-13267

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an authenticated user to gain privileges of another user via a specially crafted request...

CVE-2026-12359

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse prox...

CVE-2026-11923

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...

CVE-2026-12005

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional...

CVE-2026-12618

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied input...

CVE-2026-11937

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 and IBM Security Verify Access Container 10.0 through 10.0.9.2 Reverse Proxy in certain configurations is vulnerable to a denial of...