CVE-2023-31005

CVE-2023-31005 affects IBM Security Verify Access (Docker 10.0.0.0–10.0.6.1 and Appliance 10.0.0.0–10.0.6.1). Root cause is an improper security configuration that could allow a local user to escalate privileges. Affected products exposed multiple entry points in the container/appliance stack. Re...

CVE-2023-30433

IBM Security Verify Access 10.0 consists of an open redirect vulnerability that could allow remote attackers to conduct phishing by spoofing the URL and redirecting users to a malicious site. The issue affects IBM Security Verify Access Appliance 10.0.X and Docker 10.0.X (as documented in vendor ...

CVE-2023-32329

CVE-2023-32329 – IBM Security Verify Access (ISVA) : The vulnerability affects ISVA Docker 10.0.0.0–10.0.6.1 and ISVA Appliance 10.0.0.0–10.0.6.1. Root cause: improper file validation that could allow a user to download files from an incorrect repository. Impact statements in the sources indicate...

CVE-2024-49804

CVE-2024-49804 affects IBM Security Verify Access Appliance versions 10.0.0–10.0.8. The vulnerability allows a locally authenticated non-administrative user to escalate privileges due to unnecessary permissions used to perform certain tasks. Affected product/version details are corroborated by mu...

CVE-2019-4552

CVE-2019-4552 affects IBM Security Access Manager (ISAM) 9.0.7 and IBM Security Verify Access (ISVA) 10.0.0. The vulnerability is an HTTP response splitting flaw that a remote attacker can trigger by clicking a specially crafted URL, potentially enabling web cache poisoning, cross-site scripting,...

CVE-2023-31001

CVE-2023-31001 affects IBM Security Verify Access (ISVA) components: IBM Security Verify Access Docker 10.0.0.0–10.0.6.1 and ISVA Appliance 10.0.0.0–10.0.6.1. The issue is that the container/appliance could temporarily store sensitive information in files accessible to a local user, enabling loca...

CVE-2023-31004

IBM Security Verify Access (Docker: 10.0.0.0–10.0.6.1; Appliance: 10.0.0.0–10.0.6.1) has a CVE-2023-31004 entry describing a remote attacker who could gain access to the underlying system via man-in-the-middle techniques. The Red Hat security entry reinforces this CVE as part of IBM Security Veri...

CVE-2026-12359

Summary: CVE-2026-12359 affects IBM Security Verify Access and IBM Verify Identity Access families (and containers) with versions 10.0–10.0.9.2, 11.0–11.0.3, and corresponding containers. Affected component is the reverse proxy’s handling of HTTP requests, described as an inconsistent interpretat...

CVE-2021-20576

CVE-2021-20576 affects IBM Application Gateway (IBM Application Gateway 1.0). A remote attacker could send a specially crafted HTTP GET request that could crash the application, indicating a potential denial of service. The NVD entry lists base scores of 5.0 (MEDIUM) CVSS2 and 7.5 (HIGH) CVSS3.1/...

CVE-2023-43016

CVE-2023-43016 affects IBM Security Verify Access: IBM Security Verify Access Appliance and IBM Security Verify Access Docker images version 10.0.0.0 through 10.0.6.1. The issue allows a remote user to log into the server due to a user account configured with an empty password. The NVD/IBM adviso...

CVE-2024-43187

IBM Security Verify Access Appliance and Container versions 10.0.0–10.0.8 transmit sensitive/security-critical data in cleartext over a network channel, enabling potential information disclosure. Root cause: cleartext transmission. Affected products: IBM Security Verify Access Appliance and IBM S...

CVE-2021-20524

CVE-2021-20524 affects IBM Security Verify Access Docker 10.0.0, vulnerable to cross-site scripting in the Web UI, potentially enabling credential disclosure within a trusted session. Root cause is cross-site scripting on the Docker container UI. Remediation: upgrade to the patched container vers...

CVE-2021-20439

CVE-2021-20439 affects IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0, where credentials are stored in plain text, enabling potential read by unauthorized users. IBM published fixes: update ISAM Docker to 9.0.7.2_IF2 and Verify Access Docker to 10.0.2.0. Remediation ...

CVE-2024-49806

CVE-2024-49806 affects IBM Security Verify Access Appliance versions 10.0.0 through 10.0.8. The root cause is hard-coded credentials used for inbound authentication, outbound communication, or internal data encryption. Impact is high on confidentiality, integrity, and availability; CVSS base scor...

CVE-2021-20575

CVE-2021-20575 concerns IBM Application Gateway (IBM Application Gateway 1.0) where the application allows web pages to be stored locally and readable by other users on the same system, causing an information disclosure. The vulnerability description and multiple connected sources confirm this lo...

CVE-2021-20585

CVE-2021-20585 affects IBM Security Verify Access 20.07. It allows disclosure of sensitive information via HTTP server headers (partial confidentiality impact). No explicit root cause or remediation details are provided in the connected documents; exploitation status not described. Monitor for up...

CVE-2024-31871

CVE-2024-31871 affects IBM Security Verify Access Appliance versions 10.0.0–10.0.7. The issue arises from improper certificate validation, which could permit a malicious actor to perform a man-in-the-middle attack when deploying Python scripts. Public sources in the connected documents corroborat...

CVE-2020-4499

IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are affected by an authentication-bypass vulnerability where an unauthorized public OAuth client can bypass authentication checks and access applications. Root cause: flawed OAuth client handling that permits bypass of certai...

CVE-2021-20533

CVE-2021-20533 affects IBM Security Verify Access Docker 10.0.0 and describes a command-injection vulnerability that could allow a remote authenticated attacker to execute arbitrary commands by sending a specially crafted request. The IBM Security bulletin confirms this family of issues and lists...

CVE-2021-29665

The CVE-2021-29665 issue affects IBM Application Gateway. The connected sources confirm a stack-based buffer overflow caused by improper bounds checking, enabling local attackers to execute arbitrary code with elevated privileges. Affected product: IBM Application Gateway (reported as 1.0 in IBM’...

CVE-2021-38894

CVE-2021-38894 affects IBM Security Verify Access/Verify (10.0.0.x). Information disclosure occurs when a detailed technical error message is returned in a browser, allowing remote attackers to obtain sensitive information that could aid further attacks. Public sources confirm the issue is tied t...

CVE-2021-38921

IBM Security Verify Access 10.0.0.0 is affected by CVE-2021-38921, where weaker-than-expected cryptographic algorithms could allow decrypting highly sensitive information. The CVE is listed in IBM’s advisories and the A2E bulletin, which also identifies the affected product version (10.0.0.0) and...

CVE-2024-45658

CVE-2024-45658 affects IBM Security Verify Access Appliance and Container versions 10.0.0–10.0.8. The vulnerability is an information disclosure where a remote attacker could obtain sensitive data via a detailed technical error message, potentially enabling further attacks. IBM’s security bulleti...

CVE-2021-38956

CVE-2021-38956 affects IBM Security Verify Access (10.0.0, 10.0.1.0, 10.0.2.0) where HTTP response headers disclose sensitive version information. Root cause: information disclosure that could aid subsequent attacks. Remediation: appliances should upgrade to 10.0.3-ISS-ISVA-FP0000; for containers...

CVE-2021-38957

CVE-2021-38957 affects IBM Security Verify Access (ISVA) 10.0.0.0/10.0.1.0/10.0.2.0. Root cause: hazardous input validation during QR code generation that could disclose sensitive information. Impact: information disclosure. Remediation: upgrade ISVA appliances to 10.0.3-ISS-ISVA-FP0000 (and late...

CVE-2021-38895

CVE-2021-38895 affects IBM Security Verify Access in versions 10.0.0, 10.0.1.0, and 10.0.2.0. The vulnerability is a cross-site scripting flaw in the Web UI caused by a lack of data validation/filtering of user input and output, which could allow an attacker to inject JavaScript and potentially d...

CVE-2026-12005

CVE-2026-12005 affects IBM Security Verify Access versions 10.0–10.0.9.2, IBM Verify Identity Access 11.0–11.0.3, and IBM Verify Identity Access Container 11.0–11.0.3. The issue is an input validation vulnerability in the management interface that enables an already privileged attacker to perform...

CVE-2020-4699

CVE-2020-4699 affects IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0. The root cause is a timing side-channel vulnerability that could allow an attacker to obtain sensitive information, aiding further attacks. Affected products/files: ISAM 9.0.7 and ISVA 10.0.0. Remediati...

CVE-2020-4660

CVE-2020-4660 affects IBM Security Access Manager (ISAM) 9.0.7 and IBM Security Verify Access (ISVA) 10.0.0. The issue is an information disclosure via timing side-channel attacks that could aid in further compromise. The connected IBM bulletin confirms the vulnerability and lists the affected pr...

CVE-2026-8861

The CVE-2026-8861 entry concerns IBM Security Verify products (Identity Access and Security Verify Access). The issue arises when a detailed technical error message is returned in the browser, enabling a remote attacker to disclose sensitive information and potentially facilitate further attacks....

CVE-2026-1343

CVE-2026-1343 affects IBM Verify Identity Access Container (11.0–11.0.2), IBM Security Verify Access Container (10.0–10.0.9.1), IBM Verify Identity Access (11.0–11.0.2), and IBM Security Verify Access (10.0–10.0.9.1). The issue allows an attacker to contact internal authentication endpoints prote...

CVE-2026-1342

Summary: CVE-2026-1342 affects IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1. A locally authenticated user could execute malicious scripts outside of the ap...

CVE-2026-12004

CVE-2026-12004 is a format-string injection vulnerability in the IBM Security Verify Access management interface, affecting IBM Security Verify Access 10.0–10.0.9.2, IBM Verify Identity Access 11.0–11.0.3, and IBM Verify Identity Access Container 11.0–11.0.3. The issue can cause denial of service...

CVE-2026-1346

Technical details about CVE-2026-1346 are not publicly provided in the supplied documents. Monitor for updates from IBM/Red Hat and security feeds for affected versions, impact, and fixes.

CVE-2026-11932

IBM Security Verify Access and IBM Verify Identity Access (and their Container variants) are vulnerable to a denial-of-service attack caused by an infinite loop (CWE-835) triggered by a specially-crafted request. Affected versions are 10.0 through 10.0.9.2 and 11.0 through 11.0.3. IBM has release...

CVE-2026-11937

CVE-2026-11937 affects IBM Security Verify Access and IBM Verify Identity Access family. The reverse proxy component in certain configurations is vulnerable to denial of service. Affected: IBM Security Verify Access 10.0–10.0.9.2; IBM Verify Identity Access 11.0–11.0.3; IBM Verify Identity Access...

CVE-2026-17616

IBM Security Verify Access 10.0–10.0.9.2, Verify Identity Access 11.0–11.0.3, and their container variants have a Reverse Proxy flaw (CWE-310: Cryptographic Issues) that weakens cryptographic validation of user-supplied data, enabling potential spoofing and unauthorized access. NVD rates it criti...

CVE-2025-36356

CVE-2025-36356 affects IBM Security Verify Access and IBM Security Verify Access Docker (versions 10.0.0.0–10.0.9.0 and 11.0.0.0–11.0.1.0). The vulnerability arises from execution with more privileges than required, allowing a locally authenticated user to escalate to root. Public exploitation de...

CVE-2026-13267

CVE-2026-13267 affects IBM Security Verify Access and IBM Verify Identity Access (and their containers): authenticated users could escalate privileges to those of another user via a specially crafted request. Affected: IBM Security Verify Access 10.0–10.0.9.2; IBM Verify Identity Access 11.0–11.0...

CVE-2026-12618

CVE-2026-12618 affects IBM Security Verify Access (versions 10.0–10.0.9.2), IBM Verify Identity Access (11.0–11.0.3), and IBM Verify Identity Access Container (11.0–11.0.3). The flaw arises from improper validation of user-supplied input, allowing an administrator to execute additional commands t...

CVE-2026-1345

The CVE-2026-1345 entry affects IBM Verify Identity Access Container (11.0–11.0.2), IBM Security Verify Access Container (10.0–10.0.9.1), IBM Verify Identity Access (11.0–11.0.2), and IBM Security Verify Access (10.0–10.0.9.1). The root cause is improper validation of user-supplied input, enablin...

CVE-2026-4364

The CVE-2026-4364 entry affects IBM Verify Identity Access Container (11.0–11.0.2), IBM Security Verify Access Container (10.0–10.0.9.1), IBM Verify Identity Access (11.0–11.0.2), and IBM Security Verify Access (10.0–10.0.9.1). The root cause is that the server returns a JSON payload with the Con...

CVE-2026-4938

CVE-2026-4938 affects IBM Verify Identity Access (11.0–11.0.2) and IBM Security Verify Access (10.0–10.0.9.1) plus their Identity Access/Verify Access Containers. The vulnerability allows an attacker with read-only privileges to perform unauthorized modifications and deployments outside their ass...

CVE-2025-36354

CVE-2025-36354 affects IBM Security Verify Access and IBM Security Verify Access Docker versions 10.0.0.0–10.0.9.0 and 11.0.0.0–11.0.1.0. The issue is due to improper validation of user-supplied input, allowing an unauthenticated user to execute arbitrary commands with lower privileges. Remediati...

CVE-2026-5926

The CVE-2026-5926 affects IBM Verify Identity Access and IBM Security Verify Access products. Affected versions include IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0...

CVE-2025-36087

The CVE-2025-36087 affects IBM Security Verify Access and IBM Verify Identity Access (and their container equivalents). Affected products/versions include IBM Security Verify Access 10.0.0–10.0.9 and 11.0.0, IBM Verify Identity Access Container 10.0.0–10.0.9 and 11.0.0. The issue is hard-coded cr...

CVE-2025-36355

CVE-2025-36355 affects IBM Security Verify Access and IBM Security Verify Access Docker. A locally authenticated user could execute malicious scripts from outside the software’s control sphere in versions 10.0.0.0–10.0.9.0 and 11.0.0.0–11.0.1.0. IBM’s bulletin notes remediation via updates: IBM S...

CVE-2026-2862

CVE-2026-2862 affects IBM Verify Identity Access Container (11.0–11.0.2) and IBM Security Verify Access Container (10.0–10.0.9.1), plus IBM Verify Identity Access (11.0–11.0.2) and IBM Security Verify Access (10.0–10.0.9.1). Root cause is an inconsistent interpretation of an HTTP request by a rev...

CVE-2026-4101

CVE-2026-4101 describes an authentication bypass in IBM Verify Identity Access and IBM Security Verify Access products under certain load conditions. Affected components per sources: IBM Verify Identity Access Container 11.0–11.0.2 and IBM Security Verify Access Container 10.0–10.0.9.1, as well a...

CVE-2026-7364

CVE-2026-7364 affects IBM Verify Identity Access 11.0–11.0.2, IBM Security Verify Access 10.0–10.0.9.1, and corresponding containers. Description: an open redirect vulnerability could let a remote attacker perform phishing by sending a crafted request that redirects the victim to an arbitrary sit...