CVE-2014-6271

CVE-2014-6271 (Shellshock) affects GNU Bash up to 4.3, enabling remote code execution by processing trailing strings after function definitions in environment variables. Exploitation vectors include OpenSSH ForceCommand, mod_cgi/mod_cgid in Apache, DHCP client scripts, and other environment-passi...

CVE-2014-7169

CVE-2014-7169 affects GNU Bash up to 4.3, where parsing of function definitions in environment variables can be exploited to run commands or impact other attributes across privilege boundaries (notably via ForceCommand in OpenSSH sshd and via mod_cgi/mod_cgid in Apache, as well as DHCP client scr...

CVE-2014-6079

CVE-2014-6079 is an XSS vulnerability in IBM Security Access Manager for Web Local Management Interface affecting IBM Security Access Manager for Web 7.x (before 7.0.0-ISS-WGA-IF0009) and 8.x (before 8.0.0-ISS-WGA-FP0005), and Security Access Manager for Mobile 8.x (before 8.0.0-ISS-ISAM-FP0005)....

CVE-2015-1892

IBM Security Access Manager for Web (ISAM for Web) 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 is affected by CVE-2015-1892, a vulnerability in the mDNS responder that may reply to unicast queries from outside the local link. This can lead to information disclosure or a DoS via traffic amplifi...

CVE-2016-3016

CVE-2016-3016 affects IBM Security Access Manager for Web (and related appliances) where code origin/integrity is not sufficiently verified before processing patches, backups or updates. This could allow an authenticated attacker to load malicious code. Affected products include IBM Security Acce...

CVE-2016-3022

CVE-2016-3022 affects IBM Security Access Manager for Web. An authenticated user could gain access to highly sensitive information due to incorrect file permissions. According to IBM’s bulletin, affected appliances include Web 7.0, 8.0, 9.0 family (and Web/Mobile variants), with all firmware vers...

CVE-2014-4809

CVE-2014-4809 affects the WebSEAL component of IBM Security Access Manager for Web when e-community single sign-on is enabled. The IBM Security Access Manager for Web WebSEAL could become unresponsive under certain conditions, potentially causing a denial of service (component hang) with remote a...

CVE-2016-3017

CVE-2016-3017 affects IBM Security Access Manager (ISAM) products. The root cause is security misconfigurations that could allow a remote attacker to obtain sensitive information. Affected are IBM Security Access Manager for Web 7.0 appliances (7.0.0), 8.0 appliances (all firmware versions), IBM ...

CVE-2016-3024

CVE-2016-3024 affects IBM Security Access Manager family. IBM’s bulletin and IBM/ISAM pages confirm a local information-disclosure vulnerability where web pages containing sensitive info could be cached by the browser and read by another user on the same system. Affected products include IBM Secu...

CVE-2016-3029

CVE-2016-3029 affects IBM Security Access Manager products. IBM Security Access Manager for Web appliances (8.0.x, upgrade path to 8.0.1.5), Mobile 8.0.x, and IAM 9.0 appliances are vulnerable to cross-site request forgery, allowing unauthorized actions from a trusted user. Remediation requires a...

CVE-2015-5010

IBM Security Access Manager for Web is affected: 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 lack an account lockout after failed logins, enabling brute-force access from remote attackers. Remediation exists in the connected IBM advisories: apply Interim Fix 21 for 7...

CVE-2015-5013

CVE-2015-5013 affects IBM Security Access Manager appliances where configuration files store obfuscated plaintext passwords that can be accessed by authenticated users (local exposure). IBM’s bulletin lists affected products and firmware ranges: Web 8.0.x (8.0.0.0–8.0.1.4) with upgrade to 8.0.1.5...

CVE-2016-2908

CVE-2016-2908 is a XML External Entity (XXE) vulnerability affecting IBM Security products. IBM security advisories and IBM/Tivoli bulletins show that the flaw arises from XML parsing in affected components, enabling a remote attacker to read arbitrary files or cause a denial of service. Affected...

CVE-2015-5018

CVE-2015-5018 affects IBM Security Access Manager for Web (ISAM) on Web-based appliances: versions 7.0 before FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 are vulnerable to a command-injection via Local Management Interface (LMI) that enables remote authenticated users to execute arbi...

CVE-2016-3021

CVE-2016-3021 affects IBM Security Access Manager for Web and related appliances. An authenticated attacker could cause an error message to reveal sensitive environment data via a specially crafted HTTP request. The IBM bulletin lists affected products/versions: Web 7.0 appliances, Web 8.0.x, Web...

CVE-2016-3020

Summary of CVE-2016-3020 (IBM Security Access Manager) : IBM Security Access Manager for Web versions 7.0, 8.0, and 9.0 appliances could allow a remote attacker to bypass security restrictions due to improper content validation. By persuading a user to open specially crafted content, an attacker ...

CVE-2015-5012

CVE-2015-5012 affects IBM Security Access Manager products (Web and Mobile appliances) where the SSH MAC algorithm selection is not properly restricted. The root cause is weak MAC algorithms being enabled, potentially allowing an attacker to defeat cryptographic protection. Affected software vers...

CVE-2016-3027

CVE-2016-3027 affects IBM Security Access Manager products. The IBM Security Access Manager for Web (8.0 appliances, all firmware), Security Access Manager for Mobile (8.0), and Security Access Manager (9.0) are vulnerable to a denial of service due to an XML External Entity (XXE) issue when proc...

CVE-2016-3046

CVE-2016-3046 affects IBM Security Access Manager family (notably Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances). The vulnerability is an SQL injection in IBM Security Access Manager for Web, enabling a remote attacker to submit crafted SQL statements and view backend data. I...

CVE-2016-3043

CVE-2016-3043 corresponds to an information disclosure vulnerability in IBM Security Access Manager for Web (and related ISAM lines) caused by failure to properly enable HTTP Strict Transport Security. A remote attacker could obtain sensitive information via man-in-the-middle techniques. Affected...

CVE-2014-4823

CVE-2014-4823 affects IBM Security Access Manager for Web 7.x (before 7.0.0-ISS-WGA-IF0009) and 8.x (before 8.0.0-ISS-WGA-FP0005), plus Security Access Manager for Mobile 8.x (before 8.0.0-ISS-ISAM-FP0005). The administration console allows remote attackers to inject system commands via unspecifi...

CVE-2017-1459

CVE-2017-1459 affects IBM Security Access Manager Appliance (Web: 8.0.x, 8.0.x.x mobile; Web/Mobile 8.0–8.0.1.6; overall 9.0–9.0.3.1). The root cause is misconfigured permissions on a security-critical resource that allows read/modify by unintended actors. IBM’s security bulletin recommends upgra...

CVE-2016-3023

CVE-2016-3023 affects IBM Security Access Manager for Web and related appliances. An unauthenticated user could gain access to sensitive information by entering invalid file names. Affected: Web 7.0 appliances, Web 8.0 appliances, Mobile 8.0 appliances, and ISAM 9.0 appliances (all firmware versi...

CVE-2016-5919

IBM Security Access Manager for Web versions 7.0 (appliance), 8.0, and 9.0 are affected by CVE-2016-5919 due to weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM provides patches and upgrade paths: for Web 7.0, apply Interim Fi...

CVE-2015-8531

CVE-2015-8531 affects IBM Security Access Manager for Web: 8.0 (before 8.0.1.3 IF4) and 9.0 (before 9.0.0.1 IF1). The issue is a cross-site scripting vulnerability caused by improper validation of user-supplied input, exploitable via a specially crafted URL to execute script in a victim’s browser...

CVE-2014-3052

The vulnerability CVE-2014-3052 affects IBM Security Access Manager for Web (ISAM) v8.0, firmware 8.0.0.2 and 8.0.0.3. A defect in the reverse-proxy configuration causes the jct-nist-compliance setting to be interpreted in the opposite way, so SSL connections to backends may not enforce NIST SP 8...

CVE-2014-3053

The CVE-2014-3053 issue affects IBM Security Access Manager for Mobile (8.0, firmware 8.0.0.0–8.0.0.3) and IBM Security Access Manager for Web (7.0 and 8.0; firmware 8.0.0.2–8.0.0.3). The Local Management Interface (LMI) can be bypassed via a login action with invalid credentials, enabling authen...