CVE-2019-4155: Undefined Security Weakness

IBM API Connect's Developer Portal 2018.1 and 2018.4.1.3 is impacted by a privilege escalation vulnerability when integrated with an OpenID Connect OIDC user registry. IBM X-Force ID: 158544...

Design/Logic Flaw

IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its idtoken. IBM X-Force ID: 150902...

CVE-2018-1842

IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its idtoken. IBM X-Force ID: 150902...

CVE-2018-1842

IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its idtoken. IBM X-Force ID: 150902...

CVE-2018-1842

The CVE-2018-1842 issue affects IBM Cognos Analytics 11 Configuration tool. The root cause is a bypass of OIDC namespace signature verification on the id_token under certain conditions. This leads to a potential security impact where token validation may be weakened, allowing an attacker to explo...

PT-2018-14450

Name of the Vulnerable Software and Affected Versions IBM Cognos Analytics 11 affected versions not specified Description The issue concerns the IBM Cognos Analytics 11 Configuration tool, which under certain circumstances, bypasses OIDC namespace signature verification on its id token...

CVE-2018-1842: Improper Verification of Cryptographic Signature

IBM Cognos Analytics 11 Configuration tool, under certain circumstances, will bypass OIDC namespace signature verification on its idtoken. IBM X-Force ID: 150902...

No Apps Left Behind on Your Zero Trust Journey

Complexity kills productivity. When it comes to enabling application access, enterprises should not have to choose between user experience and complex techniques that ensure application security. Traditionally, perimeter security is built on an assumption that whatever is inside the perimeter is...

Security Bulletin: traditional WebSphere Application Serverでの権限昇格の脆弱性(CVE-2017-1151)

Summary WebSphere Application Server traditional で、OpenID Connect OIDC Trust Association Interceptor TAIを使用する場合、管理者が意図しない権限昇格が発生する脆弱性が報告されました。 この脆弱性は、WebSphere Application Server Libertyには影響しません。 最新の情報は下記の文書（英語）をご参照ください。 Security Bulletin: Privilege Escalation Vulnerability in WebSphere Applicati...

Security Bulletin: Cross-site scripting vulnerability in IBM WebSphere Application Server for Bluemix (CVE-2016-0283)

Summary There is a cross-site scripting vulnerability in Liberty for Java for IBM Bluemix when using the OpenID Connect OIDC client. Vulnerability Details CVEID: CVE-2016-0283 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting in the OIDC client web application...

Security Bulletin: Cross-site scripting vulnerability in Liberty for Java for IBM Bluemix (CVE-2016-0283)

Summary There is a cross-site scripting vulnerability in Liberty for Java for IBM Bluemix when using the OpenID Connect OIDC client. Vulnerability Details CVEID: CVE-2016-0283 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting in the OIDC client web application...

Security Bulletin: Cross-site scripting vulnerability in IBM WebSphere Application Server (CVE-2016-0283)

Summary There is a cross-site scripting vulnerability in WebSphere Application Server Liberty when using the OpenID Connect OIDC client. Vulnerability Details CVEID: CVE-2016-0283 DESCRIPTION: IBM WebSphere Application Server is vulnerable to cross-site scripting in the OIDC client web applicatio...

CVE-2017-8032: UAA Identity Zone Admin Privilege Escalation | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Versions Affected Please see additional information in the Mitigation section to determine if your foundation is affected. cf-release versions prior to v264 UAA release: All versions of UAA v2.x.x 3.6.x versions prior to v3.6.13 3.9.x versions prior t...

CVE-2017-7662

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

CVE-2017-7662

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

CVE-2017-7662

Apache CXF Fediz’s OpenID Connect Client Registration Service is vulnerable to CSRF in versions prior to 1.4.0 and 1.3.2. A malicious web app could create new clients or reset secrets after an admin logs in and the session remains active. The connected sources corroborate the same description acr...

CVE-2017-7662

Apache CXF Fediz ships with an OpenId Connect OIDC service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF Cross Style Request Forgery style vulnerability has been found in this web application in Apache CXF Fediz...

IBM WebSphere Application Server 8.0.0.10 < 8.0.0.14 / 8.5.5.3 < 8.5.5.12 / 9.0.0.0 < 9.0.0.4 OIDC Privilege Escalation

The IBM WebSphere Application Server running on the remote host is version 8.0.0.10 prior to 8.0.0.14, 8.5.5.3 prior to 8.5.5.12, or 9.0.0.0 prior to 9.0.0.4. It is, therefore, affected by a privilege escalation vulnerability in the OpenID Connect OIDC Trust Association Interceptor TAI that is...

CVE-2017-1151

IBM WebSphere Application Server 8.0, 8.5, 8.5.5, and 9.0 using OpenID Connect OIDC configured with a Trust Association Interceptor TAI could allow a user to gain elevated privileges on the system. IBM Reference : 1999293...

CVE-2017-1151

CVE-2017-1151 is an IBM WebSphere Application Server privilege-escalation vulnerability. It occurs when OpenID Connect (OIDC) is configured with a Trust Association Interceptor (TAI); under this configuration a user could gain elevated privileges on the system. Affected products/versions in the c...