CVE-2015-5013

CVE-2015-5013 affects IBM Security Access Manager appliances where configuration files store obfuscated plaintext passwords that can be accessed by authenticated users (local exposure). IBM’s bulletin lists affected products and firmware ranges: Web 8.0.x (8.0.0.0–8.0.1.4) with upgrade to 8.0.1.5...

CVE-2016-3020

Summary of CVE-2016-3020 (IBM Security Access Manager) : IBM Security Access Manager for Web versions 7.0, 8.0, and 9.0 appliances could allow a remote attacker to bypass security restrictions due to improper content validation. By persuading a user to open specially crafted content, an attacker ...

CVE-2016-3046

CVE-2016-3046 affects IBM Security Access Manager family (notably Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances). The vulnerability is an SQL injection in IBM Security Access Manager for Web, enabling a remote attacker to submit crafted SQL statements and view backend data. I...

CVE-2017-1459

CVE-2017-1459 affects IBM Security Access Manager Appliance (Web: 8.0.x, 8.0.x.x mobile; Web/Mobile 8.0–8.0.1.6; overall 9.0–9.0.3.1). The root cause is misconfigured permissions on a security-critical resource that allows read/modify by unintended actors. IBM’s security bulletin recommends upgra...

CVE-2016-3043

CVE-2016-3043 corresponds to an information disclosure vulnerability in IBM Security Access Manager for Web (and related ISAM lines) caused by failure to properly enable HTTP Strict Transport Security. A remote attacker could obtain sensitive information via man-in-the-middle techniques. Affected...

CVE-2016-5919

IBM Security Access Manager for Web versions 7.0 (appliance), 8.0, and 9.0 are affected by CVE-2016-5919 due to weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM provides patches and upgrade paths: for Web 7.0, apply Interim Fi...