CVE-2014-6082

CVE-2014-6082 affects IBM Security Access Manager for Mobile (8.x, before 8.0.1) and IBM Security Access Manager for Web (7.x before 7.0.0 FP10, and 8.x before 8.0.1). A remote authenticated user can cause an administration UI outage (denial of service) via unspecified vectors. IBM lists remediat...

CVE-2014-6078

IBM Security Access Manager for Mobile (8.0.x) and IBM Security Access Manager for Web (7.x/8.x) are affected by CVE-2014-6078, which enables brute-force login attempts due to no account lockout after invalid logins. The vulnerability is remote, low complexity, and does not require authentication...

CVE-2014-6076

CVE-2014-6076 is a clickjacking vulnerability in IBM Security Access Manager for Mobile (8.x before 8.0.1) and IBM Security Access Manager for Web (7.x before 7.0.0 FP10 and 8.x before 8.0.1). Remote attackers can lure a user to load a crafted site to hijack clicking actions. IBM’s bulletin lists...

CVE-2014-6086

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session...

CVE-2014-6076

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site...

CVE-2014-6083

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10, and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing unencrypted HTTP sessions. Affects Mobile 8.0 lineage and Web 7.x/8.x; CVSS base score ...

CVE-2014-6077

Cross-site request forgery CSRF vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences...

CVE-2014-6078

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack...

CVE-2014-6087

CVE-2014-6087 affects IBM Security Access Manager for Mobile and Web. The issue arises from weak SSL cipher suite usage that allows remote attackers to obtain sensitive information by sniffing traffic. Affected: IBM Security Access Manager for Mobile 8.0.x before 8.0.1; IBM Security Access Manage...

Oracle Adaptive Access Manager Server Arbitrary Code Execution (October 2014 CPU)

The remote Oracle Adaptive Access Manager installation is missing a vendor supplied update that fixes a flaw in Apache Struts which allows remote attackers to execute arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

Oracle Access Manager (October 2014 CPU)

The version of Oracle Access Manager installed on the remote host is affected by multiple unspecified vulnerabilities in the Admin Console. CVE-2014-6462, CVE-2014-6552, CVE-2014-6553, CVE-2014-6554 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...

CVE-2014-6554

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.1 and 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console...

CVE-2014-6553

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Admin Console...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Admin Console...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.1 and 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console...

Design/Logic Flaw

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to affect integrity via unknown vectors related to Admin Console...

CVE-2014-6554

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.1 and 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Admin Console...

CVE-2014-6552

Technical details for CVE-2014-6552 are not publicly available in the provided documents; monitor for updates as no affected product/version specifics or exploit information are disclosed here.

CVE-2014-6554

Oracle Fusion Middleware's Oracle Access Manager Admin Console (11.1.2.1/11.1.2.2) is affected by an unspecified vulnerability (CVE-2014-6554) that could allow remote authenticated users to affect confidentiality and integrity via unknown vectors. The connected sources provide limited technical d...

CVE-2014-6553

Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Admin Console...