CVE-2012-3310

TFIM (IBM Tivoli Federated Identity Manager) is affected in versions 6.1.1.14, 6.2.0.12, and 6.2.1.4 (pre-6.2.2). The vulnerability arises when a logging configuration set to all enables trace logging that exposes sensitive credentials in log files: (1) LDAP bind password, (2) keystore passwords,...

CVE-2012-3315

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

Cross site request forgery (csrf)

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

CVE-2012-3315

The Java servlets in the management console in IBM Tivoli Federated Identity Manager TFIM through 6.2.2 and Tivoli Federated Identity Manager Business Gateway TFIMBG before 6.2.2 do not require authentication for all resource downloads, which allows remote attackers to bypass intended J2EE securi...

CVE-2012-3315

CVE-2012-3315 affects the IBM Tivoli Federated Identity Manager (TFIM) and TFIM Business Gateway management consoles. Java servlets allow downloading federation metadata and a web plugin configuration template without authentication, exposing sensitive information. Impact is limited to confidenti...

CVE-2012-3314

IBM Tivoli Federated Identity Manager TFIM and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.1.1, 6.2.0, 6.2.1, and 6.2.2 allow remote attackers to establish sessions via a crafted message that leverages 1 a signature-validation bypass for SAML messages containing unsigned elements,...

CVE-2012-3314

CVE-2012-3314 affects IBM Tivoli Federated Identity Manager (TFIM) and TFIM Business Gateway (TFIMBG) versions 6.1.1, 6.2.0, 6.2.1, and 6.2.2. The IBM advisories describe three related issues that can lead to a crafted message being accepted and a session created, enabling an attacker to imperson...

CVE-2011-1386

IBM Tivoli Federated Identity Manager TFIM and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.1.1, 6.2.0, and 6.2.1 do not properly handle signature validations based on SAML 1.0, 1.1, and 2.0, which allows remote attackers to bypass intended authentication or authorization...

CVE-2011-1386

The CVE concerns IBM Tivoli Federated Identity Manager (TFIM) and TFIMBG versions 6.1.1, 6.2.0, and 6.2.1, where signature validation for SAML 1.0/1.1/2.0 is not performed correctly. This allows remote attackers to bypass authentication or authorization by submitting a non-conforming SAML signatu...

CVE-2011-3138

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

CVE-2009-5085

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when configured as an OpenID provider, does not delete the site information cookie in response to a user's deletion of a relying-party trust entry, which allows user-assisted remote attackers to bypass intended trust restrictions vi...

CVE-2011-3136

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048...

Code injection

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048...

Design/Logic Flaw

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...

Code injection

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050...

Design/Logic Flaw

IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data...

CVE-2011-3138

The CVE affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 prior to 6.2.0.9 and TFIMBG 6.2.0 prior to 6.2.0.9, where the LTPA STS module relies on a static instance of a JDK class. This static/non-thread-safe usage could allow bypass of LTPA token signature verification. The issue is tied...

CVE-2011-3137

Unspecified vulnerability in the Management Console of IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and TFIM Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 with unknown impact and attack vectors, per APAR IV03050. No exploitation details or remediation provided in the connect...

CVE-2011-3135

Technical details for CVE-2011-3135 are not publicly provided in the connected documents. The initial description notes unspecified impact and attack vectors, but no concrete affected products, versions, root causes, or fixes are documented here. Monitor for updates.

CVE-2009-5085

CVE-2009-5085 affects IBM Tivoli Federated Identity Manager (TFIM) version 6.2.0 prior to 6.2.0.2 when configured as an OpenID provider. The issue arises because TFIM does not delete the site information cookie after a user deletes a relying-party trust entry, enabling user-assisted remote attack...