IBM Tivoli Security Directory Server Information Disclosure Vulnerability (CNVD-2015-04102)

IBM Tivoli Security Directory Server now known as IBM Security Directory Server, ISDS is a suite of enterprise identity management software from IBM in the United States that uses the Lightweight Directory Access Protocol LDAP. The software provides a trusted identity data infrastructure for...

CVE-2015-1972

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request...

Deserialization of untrusted data

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other...

Cross site scripting

Cross-site scripting XSS vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site request forgery (csrf)

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request...

Design/Logic Flaw

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive...

CVE-2015-1959

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other...

CVE-2015-1972

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request...

CVE-2015-1974

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors...

CVE-2015-1978

Cross-site scripting XSS vulnerability in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2019

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not prevent caching of documents retrieved in SSL sessions, which allows physically proximate attackers to obtain sensitive...

CVE-2015-1972

CVE-2015-1972 affects IBM Tivoli/ Security Directory Server; an information-disclosure vulnerability allows a remote attacker to obtain sensitive error-log information by sending a crafted POST request. Impact is confirmed for IBM Tivoli Directory Server versions 6.0 (before iFix 75), 6.1 (before...

CVE-2015-1978

CVE-2015-1978 affects IBM Tivoli Directory Server / ISDS: cross-site scripting due to improper validation of user-supplied input. A remote attacker can inject arbitrary script/HTML via unspecified vectors, potentially stealing cookie-based credentials when a crafted URL is visited. Affected produ...

PT-2015-5525

Name of the Vulnerable Software and Affected Versions IBM Tivoli Security Directory Server versions 6.0 through 6.0 before iFix 75 IBM Tivoli Security Directory Server versions 6.1 through 6.1 before iFix 68 IBM Tivoli Security Directory Server versions 6.2 through 6.2 before iFix 44 IBM Tivoli...

PT-2015-5519

Name of the Vulnerable Software and Affected Versions IBM Tivoli Security Directory Server versions 6.0 through 6.0 before iFix 75 IBM Tivoli Security Directory Server versions 6.1 through 6.1 before iFix 68 IBM Tivoli Security Directory Server versions 6.2 through 6.2 before iFix 44 IBM Tivoli...

PT-2015-5526

Name of the Vulnerable Software and Affected Versions IBM Tivoli Security Directory Server versions 6.0 through 6.0 before iFix 75 IBM Tivoli Security Directory Server versions 6.1 through 6.1 before iFix 68 IBM Tivoli Security Directory Server versions 6.2 through 6.2 before iFix 44 IBM Tivoli...

PT-2015-5550

Name of the Vulnerable Software and Affected Versions IBM Tivoli Security Directory Server versions 6.0 through 6.0 before iFix 75 IBM Tivoli Security Directory Server versions 6.1 through 6.1 before iFix 68 IBM Tivoli Security Directory Server versions 6.2 through 6.2 before iFix 44 IBM Tivoli...

CVE-2015-1959: Improper Access Control

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other...

CVE-2015-1972: Exposure of Sensitive Information to an Unauthorized Actor

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote attackers to obtain sensitive error-log information via a crafted POST request...

CVE-2015-1974: Undefined Security Weakness

The web administration tool in IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 allows remote authenticated users to bypass intended command restrictions via unspecified vectors...