Lucene search

K
IbmSecurity Verify Access

71 matches found

CVE
CVE
added 2021/07/15 6:15 p.m.188 views

CVE-2021-29699

IBM Security Verify Access Docker 10.0.0 could allow a remote priviled user to upload arbitrary files with a dangerous file type that could be excuted by an user. IBM X-Force ID: 200600.

6.8CVSS6.7AI score0.00355EPSS
CVE
CVE
added 2023/10/14 4:15 p.m.89 views

CVE-2022-43740

IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921.

7.5CVSS7.2AI score0.00131EPSS
CVE
CVE
added 2022/03/31 6:15 p.m.88 views

CVE-2022-22311

IBM Security Verify Access could allow a user, using man in the middle techniques, to obtain sensitive information or possibly change some information due to improper validiation of JWT tokens.

6.5CVSS6.3AI score0.00172EPSS
CVE
CVE
added 2023/10/14 4:15 p.m.80 views

CVE-2022-43868

IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID: 239445.

5.3CVSS4.9AI score0.00059EPSS
CVE
CVE
added 2024/11/29 5:15 p.m.80 views

CVE-2024-49803

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request.

9.8CVSS9.5AI score0.00188EPSS
CVE
CVE
added 2025/01/20 3:15 p.m.79 views

CVE-2024-45647

IBM Security Verify Access 10.0.0 through 10.0.8 and IBM Security Verify Access Docker 10.0.0 through 10.0.8 could allow could an unverified user to change the password of an expired user without prior knowledge of that password.

9.8CVSS5.5AI score0.00042EPSS
CVE
CVE
added 2023/05/12 6:15 p.m.77 views

CVE-2023-25927

IBM Security Verify Access 10.0.0, 10.0.1, 10.0.2, 10.0.3, 10.0.4, and 10.0.5 could allow an attacker to crash the webseald process using specially crafted HTTP requests resulting in loss of access to the system. IBM X-Force ID: 247635.

7.5CVSS6.7AI score0.00049EPSS
CVE
CVE
added 2022/02/02 12:15 p.m.76 views

CVE-2021-39070

IBM Security Verify Access 10.0.0.0, 10.0.1.0 and 10.0.2.0 with the advanced access control authentication service enabled could allow an attacker to authenticate as any user on the system. IBM X-Force ID: 215353.

9.8CVSS9AI score0.00671EPSS
CVE
CVE
added 2024/03/31 12:15 p.m.72 views

CVE-2024-25027

IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.

6.2CVSS5.8AI score0.00015EPSS
CVE
CVE
added 2024/01/11 3:15 a.m.69 views

CVE-2023-38267

IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584.

6.2CVSS5.1AI score0.00009EPSS
CVE
CVE
added 2022/07/08 6:15 p.m.67 views

CVE-2022-22465

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 could allow a local user to obtain elevated privileges due to improper access permissions. IBM X-Force ID: 225082.

7.8CVSS7.1AI score0.00032EPSS
CVE
CVE
added 2024/07/25 6:15 p.m.65 views

CVE-2024-28772

IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disc...

6.8CVSS5.9AI score0.00162EPSS
CVE
CVE
added 2024/02/03 1:15 a.m.64 views

CVE-2023-30999

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow an attacker to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 254651.

7.5CVSS7.1AI score0.00034EPSS
CVE
CVE
added 2024/04/10 4:15 p.m.64 views

CVE-2024-31874

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of service. IBM X-Force ID: 287318.

6.2CVSS6AI score0.00022EPSS
CVE
CVE
added 2022/07/08 6:15 p.m.62 views

CVE-2022-22464

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 225081.

7.5CVSS7.2AI score0.00112EPSS
CVE
CVE
added 2024/04/10 4:15 p.m.60 views

CVE-2024-31872

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation. IBM X-Force ID: 287316.

8.1CVSS7.1AI score0.00049EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.58 views

CVE-2021-20511

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 198300.

6.8CVSS5.3AI score0.0043EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.58 views

CVE-2021-29742

IBM Security Verify Access Docker 10.0.0 could allow a user to impersonate another user on the system. IBM X-Force ID: 201483.

8CVSS7.4AI score0.00198EPSS
CVE
CVE
added 2022/07/08 6:15 p.m.58 views

CVE-2022-22463

IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 225079.

6.5CVSS6.7AI score0.00239EPSS
CVE
CVE
added 2024/11/29 5:15 p.m.58 views

CVE-2024-49805

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.

9.8CVSS9.3AI score0.0011EPSS
CVE
CVE
added 2024/06/27 4:15 p.m.57 views

CVE-2023-30430

IBM Security Verify Access 10.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from trace logs. IBM X-Force ID: 252183.

5.5CVSS5AI score0.00029EPSS
CVE
CVE
added 2024/02/07 5:15 p.m.57 views

CVE-2023-32328

IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957.

9.8CVSS9.2AI score0.00026EPSS
CVE
CVE
added 2025/02/04 9:15 p.m.57 views

CVE-2024-35138

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

6.5CVSS6.5AI score0.00006EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.56 views

CVE-2021-20498

IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.

5.3CVSS5.9AI score0.00163EPSS
CVE
CVE
added 2024/02/07 5:15 p.m.55 views

CVE-2023-43017

IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force ID: 266155.

8.2CVSS6.6AI score0.00016EPSS
CVE
CVE
added 2024/01/11 3:15 a.m.54 views

CVE-2023-31003

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254658.

8.4CVSS7.1AI score0.00021EPSS
CVE
CVE
added 2024/04/10 4:15 p.m.54 views

CVE-2024-31873

IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtained by a malicious actor. IBM X-Force ID: 287317.

7.5CVSS6.5AI score0.00047EPSS
CVE
CVE
added 2024/02/03 1:15 a.m.52 views

CVE-2023-31006

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of service attacks on the DSC server. IBM X-Force ID: 254776.

7.5CVSS7.1AI score0.00031EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.51 views

CVE-2021-20500

IBM Security Verify Access Docker 10.0.0 could reveal highly sensitive information to a local privileged user. IBM X-Force ID: 197980.

4.4CVSS5AI score0.00044EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.51 views

CVE-2021-20523

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 198660

4CVSS3.7AI score0.00106EPSS
CVE
CVE
added 2024/06/27 4:15 p.m.51 views

CVE-2024-31883

IBM Security Verify Access 10.0.0.0 through 10.0.7.1, under certain configurations, could allow an unauthenticated attacker to cause a denial of service due to asymmetric resource consumption. IBM X-Force ID: 287615.

5.9CVSS5.3AI score0.00061EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.50 views

CVE-2021-20496

IBM Security Verify Access Docker 10.0.0 could allow an authenticated user to bypass input due to improper input validation. IBM X-Force ID: 197966.

4.9CVSS5.2AI score0.00179EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.50 views

CVE-2021-20499

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 197973

4CVSS3.7AI score0.00106EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.50 views

CVE-2021-20510

IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 198299

6.8CVSS4.6AI score0.00053EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.50 views

CVE-2021-20534

IBM Security Verify Access Docker 10.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a mali...

4.9CVSS4.8AI score0.00076EPSS
CVE
CVE
added 2022/07/08 6:15 p.m.50 views

CVE-2022-22370

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sessi...

5.4CVSS5.2AI score0.00215EPSS
CVE
CVE
added 2024/02/03 1:15 a.m.49 views

CVE-2023-31005

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a local user to escalate their privileges due to an improper security configuration. IBM X-Force ID: 254767.

7.8CVSS7.3AI score0.00019EPSS
CVE
CVE
added 2024/02/03 1:15 a.m.49 views

CVE-2023-32329

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a user to download files from an incorrect repository due to improper file validation. IBM X-Force ID: 254972.

6.2CVSS5.5AI score0.00009EPSS
CVE
CVE
added 2025/02/20 4:15 p.m.48 views

CVE-2025-0161

IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on code generation.

7.8CVSS7.8AI score0.00006EPSS
CVE
CVE
added 2020/10/15 1:15 p.m.47 views

CVE-2019-4552

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the att...

6.1CVSS6.5AI score0.0015EPSS
CVE
CVE
added 2021/07/15 6:15 p.m.46 views

CVE-2021-20537

IBM Security Verify Access Docker 10.0.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID:198918

6.5CVSS7AI score0.00071EPSS
CVE
CVE
added 2024/08/29 5:15 p.m.46 views

CVE-2024-35133

IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL di...

8.2CVSS6.7AI score0.00641EPSS
CVE
CVE
added 2024/11/29 5:15 p.m.46 views

CVE-2024-49804

IBM Security Verify Access Appliance 10.0.0 through 10.0.8 could allow a locally authenticated non-administrative user to escalate their privileges due to unnecessary permissions used to perform certain tasks.

7.8CVSS7.6AI score0.00018EPSS
CVE
CVE
added 2023/02/17 5:15 p.m.45 views

CVE-2022-36775

IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, c...

6.5CVSS6.2AI score0.00103EPSS
CVE
CVE
added 2023/07/19 1:15 a.m.45 views

CVE-2023-30433

IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web...

6.5CVSS5.2AI score0.00053EPSS
CVE
CVE
added 2024/01/11 3:15 a.m.45 views

CVE-2023-31001

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.

5.5CVSS5AI score0.00028EPSS
CVE
CVE
added 2024/02/03 1:15 a.m.45 views

CVE-2023-31004

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a remote attacker to gain access to the underlying system using man in the middle techniques. IBM X-Force ID: 254765.

9CVSS8.6AI score0.00119EPSS
CVE
CVE
added 2024/02/07 5:15 p.m.45 views

CVE-2023-32330

IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Force ID: 254977.

9.8CVSS9AI score0.00049EPSS
CVE
CVE
added 2020/10/12 1:15 p.m.44 views

CVE-2020-4661

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system. IBM X-Force ID: 186142.

5.3CVSS4.9AI score0.00107EPSS
CVE
CVE
added 2021/07/15 4:15 p.m.44 views

CVE-2021-20439

IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user.

7.5CVSS7.3AI score0.00205EPSS
Total number of security vulnerabilities71