Information disclosure

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803...

Code injection

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512...

Design/Logic Flaw

IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IBM X-Force ID: 155193...

Open redirect

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user ...

Cross site request forgery (csrf)

IBM API Connect 5.0.0.0 through 5.0.8.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 151256...

Design/Logic Flaw

IBM API Connect 2018.1 through 2018.4.1.5 could allow an attacker to obtain sensitive information from a specially crafted HTTP request that could aid an attacker in further attacks against the system. IBM X-Force ID: 155150...

Code injection

IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle MITM attack. IBM X-Force ID: 158510...

Cross site scripting

IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

Code injection

IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality to unintended actors. IBM X-Force ID: 158574...

Design/Logic Flaw

IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 158400...

Code injection

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572...

Code injection

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...

CVE-2019-4156

CVE-2019-4156 affects IBM Security Access Manager (ISAM) software for versions 9.0.1 through 9.0.6, where weaker than expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. The issue is documented in NVD and IBM/X-Force entries, with remediation availab...

CVE-2019-4152

CVE-2019-4152 affects IBM Security Access Manager (ISAM) software, specifically ISAM 9.0.1 through 9.0.6 (and ISAM Appliance 9.0.1–9.0.6). The root cause is improper invalidation/expiration of session tokens, leading to potential login into a closed browser session by an attacker with local acces...

CVE-2019-4158

The CVE-2019-4158 entry concerns IBM Security Access Manager (ISAM) / ISAM Appliance versions 9.0.1–9.0.6 where the system fails to verify a user’s identity, potentially exposing resources or functionality to unintended actors. This is tied to ISAM 9.0.x deployments (non-appliance and appliance v...

CVE-2019-4382

IBM API Connect 5.0.0.0–5.0.8.6 contains an information-disclosure vulnerability (CVE-2019-4382) that could allow an unauthenticated user to obtain sensitive information about system users via specially crafted HTTP requests. The issue affects the LoopBack component and is rated with CVSSv3 base ...

CVE-2019-4382

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162...

CVE-2019-4377

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803...

CVE-2019-4157

IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID:...

CVE-2019-4157

CVE-2019-4157 affects IBM Security Access Manager (ISAM) software, specifically versions 9.0.1 through 9.0.6. The issue is a cross-site scripting vulnerability that lets an attacker embed arbitrary JavaScript in the Web UI, potentially altering functionality and leading to credentials disclosure ...