CVE-2020-4369

CVE-2020-4369 affects IBM Verify Gateway (IVG) 1.0.0 and 1.0.1, where the client-secret stored in cleartext in PAM configurations could be exposed. The IBM Security bulletin notes that IVG PAM components can encrypt the client-secret in /etc/pam_ibm_auth.json, but encryption is not enabled by def...

CVE-2020-4371

IBM Verify Gateway (IVG) PAM components have a leftover debug header/file in installation packages that exposes sensitive information. Affected products/versions: IVG PAM 1.0.0 and 1.0.1. Root cause: leftover debugging code/file not meant for delivery in PAM components. Impact: could be used by a...

PT-2020-18031

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue concerns the storage of highly sensitive information in cleartext, which could be accessed by a user. Recommendations For versions 1.0.0 and 1.0.1, consider implementing...

PT-2020-18033

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue concerns the storage of user credentials in plain text, allowing a local user to read them. Recommendations For versions 1.0.0 and 1.0.1, consider restricting local user...

PT-2020-18050

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue is related to an inadequate account lockout setting, which could allow a remote attacker to brute force account credentials. Recommendations For versions 1.0.0 and 1.0.1...

PT-2020-18032

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue concerns sensitive information contained in leftover debug code. This could potentially aid a local user in further attacks against the system. Recommendations For...

PT-2020-18048

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because the software transmits this information in plain text. Recommendations For...

PT-2020-18044

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue concerns hard-coded credentials, such as a password or cryptographic key, used by IBM Verify Gateway IVG for inbound authentication, outbound communication, or internal...

PT-2020-18049

Name of the Vulnerable Software and Affected Versions IBM Verify Gateway IVG versions 1.0.0 through 1.0.1 Description The issue allows an authenticated user to send malformed requests, potentially causing a denial of service against the server. Recommendations For versions 1.0.0 and 1.0.1, consid...

CVE-2020-4400: Improper Restriction of Excessive Authentication Attempts

IBM Verify Gateway IVG 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478...

CVE-2020-4399: Undefined Security Weakness

IBM Verify Gateway IVG 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Force ID: 179476...

CVE-2020-4397: Cleartext Transmission of Sensitive Information

IBM Verify Gateway IVG 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 179428...

CVE-2020-4385: Use of Hard-coded Credentials

IBM Verify Gateway IVG 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 179266...

CVE-2020-4372: Insufficiently Protected Credentials

IBM Verify Gateway IVG 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009...

CVE-2020-4369: Cleartext Storage of Sensitive Information

IBM Verify Gateway IVG 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004...

CVE-2020-4371: Insecure Storage of Sensitive Information

IBM Verify Gateway IVG 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008...

Improper Signature Verification

crypto/x509 does not properly perform certificate verification. The Certifacte.Verify ignores the requirements of provided EKUs on Windows against the VerifyOptions.KeyUsages in the verification process...

UBUNTU-CVE-2020-13847

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file...

CVE-2020-13847

CVE-2020-13847 affects Sylabs Singularity 3.0–3.5 where the signing/verification code does not sign metadata in the SIF global header or data-object descriptors, allowing signed containers to potentially behave unexpectedly if modified. Public advisories (openSUSE/SUSE) note a fix in Singularity ...

CVE-2020-13847

Sylabs Singularity 3.0 through 3.5 lacks support for an Integrity Check. Singularity's sign and verify commands do not sign metadata found in the global header or data object descriptors of a SIF file...