CVE-2022-22336

IBM Sterling External Authentication Server and IBM Sterling Secure Proxy are affected by CVE-2022-22336. The vulnerability allows a remote attacker to cause a denial of service through a resource leak in the affected components. Affected products/versions include IBM Sterling Secure Proxy 6.0.3....

CVE-2022-22333

CVE-2022-22333 affects IBM Sterling Secure Proxy and IBM Sterling External Authentication Server. Root cause: Jetty-based GUI in the Secure Zone does not properly validate the sizes of form content and/or HTTP headers, enabling a local attacker inside the Secure Zone to trigger a denial-of-servic...

CVE-2024-41783

IBM Sterling Secure Proxy is affected across versions 6.0.0.0–6.2.0.0 by an improper validation of a specified input type that could allow a privileged user to inject commands into the underlying OS. The vulnerability’s root cause is input validation failure, with a CVSS v3.1 base score of 9.1 (C...

CVE-2024-38337

IBM Sterling Secure Proxy (versions 6.0.0.0–6.2.0.0) is affected by an improper permission assignment vulnerability (CWE-732) that could allow an unauthorized attacker to retrieve or alter sensitive information due to incorrect permissions on a critical resource. The IBM Security Bulletin confirm...

CVE-2021-29726

CVE-2021-29726 affects IBM Sterling Secure Proxy 6.0.3 and IBM Secure External Authentication Server 6.0.3. The issue is improper validation leading to a certificate not being properly associated with the host (trust management/certificate validation bypass). Reported base CVSS v3.1/3.0 scores ar...

CVE-2024-41784

CVE-2024-41784 affects IBM Sterling Secure Proxy 6.0.0.0–6.1.0.0 and is a directory-traversal vulnerability exploited by specially crafted URLs containing "/.../" to view arbitrary system files. IBM and CVE records confirm this risk and provide fixes: upgrades to 6.0.3.1 GA or 6.1.0.1 GA (and rel...

CVE-2022-34361

CVE-2022-34361 affects IBM Sterling Secure Proxy 6.0.3. The issue arises from using weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. The IBM bulletin lists the affected product/version and provides a remediation: upgrade to the ...

CVE-2022-35720

CVE-2022-35720 affects IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3, due to use of weaker-than-expected cryptographic algorithms during installation, which could let a local attacker decrypt sensitive information. Remediation references in IBM advisories s...

CVE-2023-47699

CVE-2023-47699 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0. A cross-site scripting vulnerability in the Web UI could let an attacker embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. The NVD/IBM entries list a base score of 6.1 (Medi...

CVE-2023-46179

IBM Sterling Secure Proxy is affected on versions 6.0.3 and 6.1.0 by a vulnerability where authorization tokens or session cookies lack the secure attribute. The issue lets an attacker potentially obtain cookie values by tricking a user into visiting a http link or via a site the user visits, ena...

CVE-2024-38341

CVE-2024-38341 affects IBM Sterling Secure Proxy. Affected versions are 6.0.0.0–6.0.3.1, 6.1.0.0–6.1.0.1, and 6.2.0.0–6.2.0.1. The root cause is use of weaker than expected cryptographic algorithms during hashing, which could allow an attacker to decrypt highly sensitive information (information ...

CVE-2024-51453

IBM Sterling Secure Proxy versions 6.2.0.0–6.2.0.1 are affected by a path traversal vulnerability that allows a remote attacker to view arbitrary files by sending URL requests containing dot-dot (../) sequences. Root cause: directory traversal in the web interface/file handling. Impact per IBM bu...

CVE-2021-29723

CVE-2021-29723 concerns IBM Sterling Secure Proxy/Sterling Proxy vulnerabilities where several releases (IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2) use weaker-than-expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information. The conn...

CVE-2022-34362

IBM Sterling Secure Proxy 6.0.3 is affected by an HTTP header injection flaw caused by insufficient validation of HOST headers. The vulnerability could enable attacks such as cross-site scripting, cache poisoning, or session hijacking against vulnerable systems. Affected product/version: IBM Ster...

CVE-2023-46182

CVE-2023-46182 affects IBM Sterling Secure Proxy 6.0.3 and 6.1.0. The issue is a cross-site scripting vulnerability in the Web UI that lets an attacker embed arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. Accessible in the Web UI, the vulnerability’s ...

CVE-2021-29749

IBM Secure External Authentication Server 6.0.2 and IBM Secure Proxy 6.0.2 are affected by a server-side request forgery (SSRF). An authenticated attacker could trigger unauthorized requests from the system, potentially enabling network enumeration or related attacks. CVSS v3 base score is 6.5 (A...

CVE-2021-29725

CVE-2021-29725 affects IBM Secure External Authentication Server (versions 2.4.3.2, 6.0.1, 6.0.2) and IBM Secure Proxy (versions 3.4.3.2, 6.0.1, 6.0.2). The issue is a resource leak that could allow a remote attacker to exhaust resources and cause a denial of service. Connected IBM advisories ide...

CVE-2023-46181

CVE-2023-46181 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0. The issue allows web pages to be stored locally and read by another user on the same system (information disclosure). Remediation: upgrade to IBM Sterling Secure Proxy iFix 11 (for 6.0.3) or iFix 03 (for 6.1.0) per IBM. Ot...

CVE-2023-47162

CVE-2023-47162 affects IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0 and is a cross-site scripting vulnerability in the Web UI that could allow embedding arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The connected IBM and CNVD entries confirm t...

CVE-2013-0520

CVE-2013-0520 affects IBM Sterling Secure Proxy: vulnerable in 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7. The issue allows remote authenticated users to obtain sensitive Java stack traces by sending invalid input. Remediation is ...

CVE-2023-47147

IBM Sterling Secure Proxy versions 6.0.3 and 6.1.0 are affected by a vulnerability that could allow an attacker to overwrite a log message under specific conditions. The issue is addressed by upgrading to iFix 11 for 6.0.3 and iFix 03 for 6.1.0. Remediation details are provided in IBM’s advisorie...

CVE-2016-6027

CVE-2016-6027 affects IBM Sterling Secure Proxy Configuration Manager (SSP CM). The issue is that HSTS protection was not enabled in SSP Configuration Manager, making it possible for an attacker to obtain sensitive information or modify data by exploiting HTTP instead of HTTPS. Affected versions ...

CVE-2021-29728

CVE-2021-29728 affects IBM Sterling Secure Proxy/Sterling Proxy components. The connected documents confirm hard-coded credentials (passwords or keys) used for inbound authentication, outbound communication, or internal data encryption in versions 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2. Implications ...

CVE-2023-32338

CVE-2023-32338 affects IBM Sterling Secure Proxy and IBM Sterling External Authentication Server (versions 6.0.3 and 6.1.0). The root cause is storing user credentials in plain text, readable by a local user with container access. Reported impact is credential disclosure with high confidentiality...

CVE-2016-6023

IBM Sterling Secure Proxy Configuration Manager is affected by CVE-2016-6023, a directory traversal vulnerability in SSP 3.4.2 (prior to 3.4.2.0 iFix 8) and 3.4.3 (prior to 3.4.3.0 iFix 1). An attacker can read arbitrary files via a crafted URL. The issue is addressed by applying the fixed releas...

CVE-2020-4462

CVE-2020-4462 concerns IBM Sterling External Authentication Server and IBM Sterling Secure Proxy. The NVD and IBM advisories describe an XML External Entity (XXE) vulnerability when processing XML data that could allow a remote attacker to expose sensitive information or consume memory resources....

CVE-2021-29722

CVE-2021-29722 affects IBM Sterling Secure Proxy components: 2.4.3.2, 3.4.3.2, 6.0.1, and 6.0.2. The root cause is use of weaker cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. Evidence from multiple sources (NVD entry and IBM security bulletins) con...

CVE-2013-0518

IBM Sterling Secure Proxy is affected by CVE-2013-0518 (and related CVEs) where certain 3.2.0, 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 do not refuse rendering in third‑party frames, enabling clickjacking. Affected versions: SSP 3.2.0, 3....

CVE-2013-0519

CVE-2013-0519 affects IBM Sterling Secure Proxy 3.2.0, 3.3.01 before 3.3.01.23 iFix 1, 3.4.0 before 3.4.0.6 iFix 1, and 3.4.1 before 3.4.1.7, where the web-server version is disclosed in (1) an unspecified page title and (2) an HTTP header, enabling remote disclosure of a version string. IBM reme...

CVE-2016-6025

CVE-2016-6025 affects IBM Sterling Secure Proxy (SSP) Configuration Manager. The issue occurs in SSP versions 3.4.2 before iFix 8 and 3.4.3 before iFix 1, where a post-logoff session-reuse attack via a modified URL could allow remote attackers to obtain access. The vulnerability is tied to the Co...

CVE-2016-6026

The CVE-2016-6026 issue affects IBM Sterling Secure Proxy Configuration Manager in SSP, specifically the Configuration Manager component. Affected versions are IBM Sterling Secure Proxy 3.4.3 GA and 3.4.2 through 3.4.2.0 with iFix levels (3.4.3.0 iFix 1; 3.4.2.0 iFix 7). The vulnerability allows ...