CVE-2009-5084

CVE-2009-5084 affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 prior to 6.2.0.2. When the InfoCardSTSDelegate tracing is enabled, TFIM writes a cleartext log entry that includes a password, exposing sensitive credentials to local users who can read the logs. The impact is a potential pa...

CVE-2009-5083

CVE-2009-5083 affects IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 prior to 6.2.0.2 when configured as an OpenID relying party. The underlying issue is that the component does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, allowing a remote...

CVE-2011-3137

Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03050...

CVE-2011-3135

Technical details for CVE-2011-3135 are not publicly provided in the connected documents. The initial description notes unspecified impact and attack vectors, but no concrete affected products, versions, root causes, or fixes are documented here. Monitor for updates.

CVE-2008-7299

IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 is vulnerable to a spoofing issue in its SAML 1.x browser-artifact handling. The root cause is an incomplete browser-artifact mechanism that enables remote OpenID providers to spoof assertions via the Issuer field, affecting TFIM versions prior t...

CVE-2011-3135

Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 has unknown impact and attack vectors...

CVE-2011-3138

The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager TFIM 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway TFIMBG 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit JDK class, which might allow attackers to bypass...