CVE-2019-4151
published 2019-06-25CVE-2019-4151: IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…
PriorityP429medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.87%
54.5th percentile
IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | — | — |
| ibm | security_access_manager | 9.0.1 – 9.0.6 | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
osv7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hm9h-qvfm-ggw4: IBM Security Access Manager 9
ghsa_unreviewed·2022-05-24
CVE-2019-4151 [MEDIUM] CWE-326 GHSA-hm9h-qvfm-ggw4: IBM Security Access Manager 9
IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.
OSV
python2.7, python3.4 vulnerabilities
osv·2019-10-10·CVSS 7.5
CVE-2019-16056 python2.7, python3.4 vulnerabilities
python2.7, python3.4 vulnerabilities
USN-4151-1 fixed several vulnerabilities in Python. This update provides
the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.
Original advisory details:
It was discovered that Python incorrectly parsed certain email addresses. A
remote attacker could possibly use this issue to trick Python applications
into accepting email addresses that should be denied. (CVE-2019-16056)
It was discovered that the Python documentation XML-RPC server incorrectly
handled certain fields. A remote attacker could use this issue to execute a
cross-site scripting (XSS) attack. (CVE-2019-16935)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-06-25
Published