CVE-2019-19988

The CVE-2019-19988 issue affects Selesta Visual Access Manager (VAM) versions 4.15.0–4.29. An authenticated user can create and write arbitrary files on the filesystem via the web interface, by manipulating the file name, destination path, or extension in /common/vam_editXml.php. The vulnerable p...

CVE-2019-19989

Selesta Visual Access Manager (VAM) versions 4.15.0–4.29 contain an unauthorized access issue where several PHP pages and other file types are reachable without checking user identity or authorization. Root cause: lack of access checks on these pages. Impact: potential exposure of PHP pages or fi...

CVE-2019-19990

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Multiple Stored Cross-site scripting XSS vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via the web pages /monitor/sheadmodel.php and /vam/vamuser.php...

CVE-2019-19991

CVE-2019-19991 concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29, where multiple reflected XSS flaws are exploitable by remote authenticated users. The vulnerabilities affect specific web pages: /vam/vam_anagraphic.php, /vam/vam_vamuser.php, /common/vamp_main.php, and /wiz...

CVE-2019-19993

Selesta Visual Access Manager (VAM) 4.15.0–4.29.x contains a full path disclosure vulnerability. An unauthenticated attacker can send arbitrary content to vulnerable pages, causing error messages that reveal full filesystem paths. Impact described as confidentiality exposure (partial). Root cause...

CVE-2019-19993

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. Several full path disclosure vulnerability were discovered. A user, even with no authentication, may simply send arbitrary content to the vulnerable pages to generate error messages that expose some full paths...

CVE-2019-19994

An issue was discovered in Selesta Visual Access Manager VAM 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vammonitorsap.php...

CVE-2019-19994

The CVE-2019-19994 entry concerns Selesta Visual Access Manager (VAM) versions 4.15.0 through 4.29. It describes a vulnerability in the PHP page /common/vam_monitor_sap.php that allows blind command injection. The issue can be exploited by an attacker without authentication to execute arbitrary o...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2019-4720)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Security Bulletin: A Security Vulnerability Has Been Identified In IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On (CVE-2020-4163)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletin...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Security Access Manager for Enterprise Single Sign-On January 2020 CPU

Summary These issues were also addressed by IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On. Vulnerability Details Refer to the security bulletinss listed in the Remediation/Fixes section Affected Products and Versions IBM Security Access...

Security Bulletin: A security vulnerability was identified in WebSphere Application Server as shipped with IBM Tivoli Access Manager for e-business (CVE-2019-4670)

Summary WebSphere Application Server is shipped with IBM Tivoli Access Manager for e-business. Information about a security bulletin affecting WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletinss listed in the...

IBM Security Access Manager Appliance XXE Injection Vulnerability

The IBM Security Access Manager Appliance is a network appliance-based security solution. An XXE attack vulnerability exists in IBM Security Access Manager Appliance's handling of XML data, which allows remote attackers to exploit the vulnerability by submitting a special XML request that can be...

Security Bulletin: Security vulnerabilities in the jackson-databind routines fixed in IBM Security Access Manager

Summary Security vulnerabilities were fixed in the IBM Security Access Manager appliance in the jackson-databind utilities. Vulnerability Details CVEID: CVE-2019-14439 DESCRIPTION: A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default...

Security Bulletin: Security vulnerabilities in the jackson-databind routines fixed in IBM Security Access Manager

Summary Security vulnerabilities were fixed in the IBM Security Access Manager appliance in the jackson-databind utilities. Vulnerability Details CVEID: CVE-2019-20330 DESCRIPTION: A lacking of certain net.sf.ehcache blocking in FasterXML jackson-databind has an unknown impact and attack vector...

CVE-2019-4707

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...

CVE-2019-4707

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...

Xxe

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...

CVE-2019-4707

IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 172018...

CVE-2019-4707

IBM Security Access Manager Appliance is affected by CVE-2019-4707 due to an XML External Entity (XXE) injection when processing XML data. The issue impacts ISAM 9.0.x (specifically 9.0.7.0) and could allow an unauthenticated or remote attacker to access sensitive information or exhaust memory/re...