CVE-2018-1945

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click...

Information disclosure

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...

CVE-2018-1950

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430...

Why the Pipeline Cybersecurity Initiative is a critical step

It’s well known by now that pipeline attacks and attacks on utilities of all kinds have been an unfortunately well-trodden path by cyber-adversaries in numerous countries for a few years now. These types of attacks are not theoretical, and the damage done to date—as well as the potential damage—i...

CVE-2018-1945

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click...

CVE-2018-1946

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the...

CVE-2018-1946

CVE-2018-1946 involves IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2 through 5.2.4.1. The issue is not a bug in code execution but a design/crypto negotiation flaw: multiple actors can negotiate which protection algorithms (e.g., encryption/authentication)...

CVE-2018-1944

Summary: CVE-2018-1944 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance, specifically versions 5.2 through 5.2.4.1. The root cause is hard-coded credentials (passwords or cryptographic keys) used for inbound authentication, outbound communication to external compo...

CVE-2018-1950

The CVE affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2–5.2.4.1. The disclosed vulnerability is an information disclosure: an error message reveals sensitive details about the environment, users, or related data, which could aid further attacks. Root...

CVE-2018-1949

The CVE-2018-1949 entry affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance, specifically IGI versions 5.2 through 5.2.4.1. The vulnerability is an information disclosure issue where sensitive data may be exposed to unauthorized users, enabling further attacks on the...

CVE-2018-1945

CVE-2018-1945 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance 5.2–5.2.4.1. The vulnerability lets a remote attacker hijack a victim’s click actions by luring them to a malicious website, potentially enabling further attacks. Remediation is available: upgrade IGI ...

CVE-2018-1947

CVE-2018-1947 affects IBM Security Identity Governance and Intelligence (IGI) Virtual Appliance versions 5.2–5.2.4.1. The Web UI is vulnerable to cross-site scripting, enabling an attacker to embed arbitrary JavaScript in the UI and potentially disclose credentials within a trusted session. Root ...

The Russian Sleuth Who Outs Moscow's Elite Hackers and Assassins

Roman Dobrokhotov has been playing a dangerous game for a Russian reporter: identifying agents of the GRU military intelligence agency...

PT-2019-9807

Name of the Vulnerable Software and Affected Versions IBM Security Identity Governance and Intelligence versions 5.2 through 5.2.4.1 Virtual Appliance Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used for inbound authentication, outbound...

CVE-2018-1947: Improper Neutralization of Input During Web Page Generation

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

IBM Security Identity Governance and Intelligence Information Disclosure Vulnerability (CNVD-2019-05515)

IBM Security Identity Governance and Intelligence IGI is a suite of identity governance solutions from IBM in the United States. The product includes features such as lifecycle management, access risk assessment and identity management. A security vulnerability exists in IBM Security IGI that ste...

CVE-2018-1949: Exposure of Sensitive Information to an Unauthorized Actor

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429...

CVE-2018-1946: Inadequate Encryption Strength

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the...

CVE-2018-1944: Use of Hard-coded Credentials

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM...

CVE-2018-1948: Session Fixation

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes...