CVE-2016-3016

CVE-2016-3016 affects IBM Security Access Manager for Web (and related appliances) where code origin/integrity is not sufficiently verified before processing patches, backups or updates. This could allow an authenticated attacker to load malicious code. Affected products include IBM Security Acce...

CVE-2016-3022

CVE-2016-3022 affects IBM Security Access Manager for Web. An authenticated user could gain access to highly sensitive information due to incorrect file permissions. According to IBM’s bulletin, affected appliances include Web 7.0, 8.0, 9.0 family (and Web/Mobile variants), with all firmware vers...

CVE-2015-5010

IBM Security Access Manager for Web is affected: 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 lack an account lockout after failed logins, enabling brute-force access from remote attackers. Remediation exists in the connected IBM advisories: apply Interim Fix 21 for 7...

CVE-2015-5013

CVE-2015-5013 affects IBM Security Access Manager appliances where configuration files store obfuscated plaintext passwords that can be accessed by authenticated users (local exposure). IBM’s bulletin lists affected products and firmware ranges: Web 8.0.x (8.0.0.0–8.0.1.4) with upgrade to 8.0.1.5...

CVE-2016-3017

CVE-2016-3017 affects IBM Security Access Manager (ISAM) products. The root cause is security misconfigurations that could allow a remote attacker to obtain sensitive information. Affected are IBM Security Access Manager for Web 7.0 appliances (7.0.0), 8.0 appliances (all firmware versions), IBM ...

CVE-2016-3029

CVE-2016-3029 affects IBM Security Access Manager products. IBM Security Access Manager for Web appliances (8.0.x, upgrade path to 8.0.1.5), Mobile 8.0.x, and IAM 9.0 appliances are vulnerable to cross-site request forgery, allowing unauthorized actions from a trusted user. Remediation requires a...

CVE-2016-3024

CVE-2016-3024 affects IBM Security Access Manager family. IBM’s bulletin and IBM/ISAM pages confirm a local information-disclosure vulnerability where web pages containing sensitive info could be cached by the browser and read by another user on the same system. Affected products include IBM Secu...

CVE-2016-2908

CVE-2016-2908 is a XML External Entity (XXE) vulnerability affecting IBM Security products. IBM security advisories and IBM/Tivoli bulletins show that the flaw arises from XML parsing in affected components, enabling a remote attacker to read arbitrary files or cause a denial of service. Affected...

CVE-2015-5018

CVE-2015-5018 affects IBM Security Access Manager for Web (ISAM) on Web-based appliances: versions 7.0 before FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 are vulnerable to a command-injection via Local Management Interface (LMI) that enables remote authenticated users to execute arbi...

CVE-2017-1477

Summary: CVE-2017-1477 affects IBM Security Access Manager Appliance 9.0.3.0, where an XML External Entity (XXE) vulnerability exists when processing XML data, potentially exposing sensitive information or exhausting memory resources. Affected product/versions (per sources): IBM Security Access M...

CVE-2017-1533

IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting via the Web UI, potentially enabling credential disclosure in a trusted session. The IBM bulletin (Vulnerability CVE-2017-1533) lists affected versions 9.0.3.0–9.0.3.1 and provides a remediation: upgrade to 9.0.4.0 ...

CVE-2017-1453

CVE-2017-1453 affects IBM Security Access Manager Appliance 9.0.3. An authenticated remote attacker could issue a specially crafted request to execute arbitrary commands on the system (command injection). The CVSSv3 base score is 8.8 (HIGH) with network access, low attack complexity, and local pr...

CVE-2017-1478

Summary: IBM Security Access Manager Appliance 9.0.0 is affected by a local information-disclosure vulnerability where web pages can be stored locally and read by another user on the same system. This affects IBM Security Access Manager Appliance versions 9.0 through 9.0.3.1. The root cause invol...

CVE-2016-3051

IBM Security Access Manager for Web 9.0.0 is affected by CVE-2016-3051, where an authenticated user could access some privileged server functionality. The IBM bulletin specifies remediation by upgrading to 9.0.3.0 (VRMF 9.0.3) for IBM Security Access Manager appliances. No mitigations/workarounds...

CVE-2015-5012

CVE-2015-5012 affects IBM Security Access Manager products (Web and Mobile appliances) where the SSH MAC algorithm selection is not properly restricted. The root cause is weak MAC algorithms being enabled, potentially allowing an attacker to defeat cryptographic protection. Affected software vers...

CVE-2016-3021

CVE-2016-3021 affects IBM Security Access Manager for Web and related appliances. An authenticated attacker could cause an error message to reveal sensitive environment data via a specially crafted HTTP request. The IBM bulletin lists affected products/versions: Web 7.0 appliances, Web 8.0.x, Web...

CVE-2016-3019

CVE-2016-3019 concerns IBM Security Access Manager (ISAM) for Web 9.0.0 where weaker-than-expected cryptographic algorithms could allow an attacker to decrypt highly sensitive information. Connected IBM advisories confirm the issue affects IBM Security Access Manager appliances running ISAM 9.0 a...

CVE-2016-3020

Summary of CVE-2016-3020 (IBM Security Access Manager) : IBM Security Access Manager for Web versions 7.0, 8.0, and 9.0 appliances could allow a remote attacker to bypass security restrictions due to improper content validation. By persuading a user to open specially crafted content, an attacker ...

CVE-2016-3046

CVE-2016-3046 affects IBM Security Access Manager family (notably Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances). The vulnerability is an SQL injection in IBM Security Access Manager for Web, enabling a remote attacker to submit crafted SQL statements and view backend data. I...

CVE-2016-3023

CVE-2016-3023 affects IBM Security Access Manager for Web and related appliances. An unauthenticated user could gain access to sensitive information by entering invalid file names. Affected: Web 7.0 appliances, Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances (all firmware versi...

CVE-2016-3027

CVE-2016-3027 affects IBM Security Access Manager products. The IBM Security Access Manager for Web (8.0 appliances, all firmware), Security Access Manager for Mobile (8.0), and Security Access Manager (9.0) are vulnerable to a denial of service due to an XML External Entity (XXE) issue when proc...

CVE-2016-3043

CVE-2016-3043 corresponds to an information disclosure vulnerability in IBM Security Access Manager for Web (and related ISAM lines) caused by failure to properly enable HTTP Strict Transport Security. A remote attacker could obtain sensitive information via man-in-the-middle techniques. Affected...

CVE-2017-1459

CVE-2017-1459 affects IBM Security Access Manager Appliance (Web: 8.0.x, 8.0.x.x mobile; Web/Mobile 8.0–8.0.1.6; overall 9.0–9.0.3.1). The root cause is misconfigured permissions on a security-critical resource that allows read/modify by unintended actors. IBM’s security bulletin recommends upgra...

CVE-2016-5919

IBM Security Access Manager for Web versions 7.0 (appliance), 8.0, and 9.0 are affected by CVE-2016-5919 due to weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM provides patches and upgrade paths: for Web 7.0, apply Interim Fi...

CVE-2015-8531

CVE-2015-8531 affects IBM Security Access Manager for Web: 8.0 (before 8.0.1.3 IF4) and 9.0 (before 9.0.0.1 IF1). The issue is a cross-site scripting vulnerability caused by improper validation of user-supplied input, exploitable via a specially crafted URL to execute script in a victim’s browser...