Security Access Manager@* Security Vulnerabilities and Issues — Security Access Manager@* CVE List

Lucene search

IbmSecurity Access Manager*

36 matches found

CVE•added 2019/06/25 4:15 p.m.•144 views

CVE-2019-4153

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to...

6.8CVSS6.7AI score0.00096EPSS

CVE•added 2019/06/25 4:15 p.m.•136 views

CVE-2019-4135

IBM Security Access Manager 9.0.1 through 9.0.6 is affected by a security vulnerability that could allow authenticated users to impersonate other users. IBM X-Force ID: 158331.

8.8CVSS8.4AI score0.0063EPSS

CVE•added 2019/06/25 4:15 p.m.•132 views

CVE-2019-4152

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 158515.

5.1CVSS4.6AI score0.00042EPSS

CVE•added 2019/06/25 4:15 p.m.•122 views

CVE-2019-4156

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572.

5.9CVSS6.2AI score0.00112EPSS

CVE•added 2019/06/25 4:15 p.m.•102 views

CVE-2019-4145

IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 158400.

7.7CVSS6.9AI score0.00045EPSS

CVE•added 2019/06/25 4:15 p.m.•102 views

CVE-2019-4151

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.

5.9CVSS6.2AI score0.00112EPSS

CVE•added 2019/10/25 5:15 p.m.•101 views

CVE-2019-4036

IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component. IBM X-Force ID: 156159.

7.5CVSS7.2AI score0.00529EPSS

CVE•added 2019/06/25 4:15 p.m.•97 views

CVE-2019-4150

IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-Force ID: 158510.

4.3CVSS5AI score0.00075EPSS

CVE•added 2019/06/25 4:15 p.m.•96 views

CVE-2019-4158

IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality to unintended actors. IBM X-Force ID: 158574.

5.5CVSS6.1AI score0.00089EPSS

CVE•added 2019/06/25 4:15 p.m.•95 views

CVE-2019-4157

IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 15...

6.1CVSS6AI score0.00218EPSS

CVE•added 2024/06/28 4:15 p.m.•70 views

CVE-2024-35139

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415.

6.2CVSS5.7AI score0.00009EPSS

CVE•added 2024/06/28 4:15 p.m.•60 views

CVE-2024-35137

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.

6.2CVSS6.2AI score0.0001EPSS

CVE•added 2024/06/27 7:15 p.m.•59 views

CVE-2023-38370

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: 261197.

7.5CVSS6.8AI score0.00074EPSS

CVE•added 2024/06/27 6:15 p.m.•56 views

CVE-2023-38371

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 261198.

7.5CVSS6.3AI score0.00047EPSS

CVE•added 2024/06/27 7:15 p.m.•52 views

CVE-2023-30997

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254638.

7.8CVSS7.4AI score0.00023EPSS

CVE•added 2024/06/27 7:15 p.m.•51 views

CVE-2023-38368

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: 261195.

5.5CVSS5.3AI score0.0002EPSS

CVE•added 2024/06/27 7:15 p.m.•50 views

CVE-2023-30998

IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649.

7.8CVSS7.4AI score0.00023EPSS

CVE•added 2018/06/06 5:29 p.m.•48 views

CVE-2017-1474

IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 128606.

5.3CVSS4.8AI score0.00191EPSS

CVE•added 2020/10/15 1:15 p.m.•47 views

CVE-2019-4552

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the att...

6.1CVSS6.5AI score0.0015EPSS

CVE•added 2018/12/13 4:29 p.m.•46 views

CVE-2018-1814

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 150018.

7.5CVSS7.6AI score0.00112EPSS

CVE•added 2018/03/08 4:29 p.m.•45 views

CVE-2018-1443

An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a diffe...

5.9CVSS5.4AI score0.00061EPSS

CVE•added 2018/12/13 4:29 p.m.•44 views

CVE-2018-1804

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.

4.3CVSS4.8AI score0.00139EPSS

CVE•added 2018/12/13 4:29 p.m.•42 views

CVE-2018-1803

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click acti...

6.1CVSS6.6AI score0.00145EPSS

CVE•added 2018/12/13 4:29 p.m.•42 views

CVE-2018-1813

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 150017.

6.5CVSS6.9AI score0.00126EPSS

CVE•added 2018/06/06 5:29 p.m.•41 views

CVE-2017-1480

IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read by a remote user. IBM X-Force ID: 128617.

4.3CVSS4.2AI score0.00128EPSS

CVE•added 2018/12/13 4:29 p.m.•41 views

CVE-2018-1740

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within...

5.4CVSS5.3AI score0.00158EPSS

CVE•added 2018/12/13 4:29 p.m.•40 views

CVE-2018-1653

5.4CVSS5.6AI score0.00161EPSS

CVE•added 2020/10/15 1:15 p.m.•39 views

CVE-2020-4499

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications. IBM X-Force ID: 182216.

9.8CVSS9.2AI score0.00383EPSS

CVE•added 2020/05/20 1:15 p.m.•38 views

CVE-2020-4461

IBM Security Access Manager Appliance 9.0.7.1 could allow an authenticated user to bypass security by allowing id_token claims manipulation without verification. IBM X-Force ID: 181481.

6.5CVSS6.1AI score0.00174EPSS

CVE•added 2018/12/13 4:29 p.m.•37 views

CVE-2018-1815

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

6.1CVSS6AI score0.00166EPSS

CVE•added 2018/12/13 4:29 p.m.•37 views

CVE-2018-1886

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 152021.

5.3CVSS5.7AI score0.0014EPSS

CVE•added 2018/06/06 5:29 p.m.•36 views

CVE-2017-1476

IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive info...

5.9CVSS5.3AI score0.00263EPSS

CVE•added 2018/12/13 4:29 p.m.•36 views

CVE-2018-1805

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 149704.

4.3CVSS5.2AI score0.00119EPSS

CVE•added 2019/02/04 9:29 p.m.•36 views

CVE-2018-1970

IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 153751.

7.1CVSS7AI score0.00359EPSS

CVE•added 2018/12/13 4:29 p.m.•33 views

CVE-2018-1887

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Forc...

7.8CVSS8AI score0.00016EPSS

CVE•added 2020/10/06 4:15 p.m.•33 views

CVE-2019-4725

IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172131.

6.1CVSS5.7AI score0.00188EPSS