Ibm Security Access Manager vulnerabilities

CVE-2016-3019 [MEDIUM] CWE-326 CVE-2016-3019: IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that co IBM Security Access Manager for Web 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 114462.

CVE-2017-1476 [MEDIUM] CWE-200 CVE-2017-1476: IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM X-Force

CVE-2019-4145 [HIGH] CVE-2019-4145: IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditi IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 158400.

CVE-2019-4153 [MEDIUM] CWE-601 CVE-2019-4153: IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing at IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted.

CVE-2019-4151 [MEDIUM] CWE-326 CVE-2019-4151: IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms t IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.

CVE-2019-4156 [MEDIUM] CWE-327 CVE-2019-4156: IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms t IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572.

CVE-2024-35137 [MEDIUM] CWE-258 CVE-2024-35137: IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly el IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413.

CVE-2017-1474 [MEDIUM] CWE-200 CVE-2017-1474: IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 disclo IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 128606.

CVE-2018-1803 [MEDIUM] CWE-1021 CVE-2018-1803: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the vi

CVE-2017-1489 [MEDIUM] CWE-601 CVE-2017-1489: IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a r IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an e-community domain. IBM X-Force ID: 128687.

CVE-2019-4552 [MEDIUM] CVE-2019-4552: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP respo IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning,

CVE-2019-4158 [MEDIUM] CWE-862 CVE-2019-4158: IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct whi IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality to unintended actors. IBM X-Force ID: 158574.

CVE-2018-1886 [MEDIUM] CWE-200 CVE-2018-1886: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sens IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 152021.

CVE-2017-1534 [MEDIUM] CWE-601 CVE-2017-1534: IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phish IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be tr

CVE-2019-4157 [MEDIUM] CWE-79 CVE-2019-4157: IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerab IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158573.

CVE-2018-1815 [MEDIUM] CWE-79 CVE-2018-1815: IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 for Enterprise Single-Sign On is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X

CVE-2019-4725 [MEDIUM] CWE-79 CVE-2019-4725: IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability IBM Security Access Manager Appliance 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 172131.

CVE-2018-1443 [MEDIUM] CWE-287 CVE-2018-1443: An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Acces An XML parsing vulnerability affects IBM SAML-based single sign-on (SSO) systems (IBM Security Access Manager 9.0.0 - 9.0.4 and IBM Tivoli Federated Identity Manager 6.2 - 6.0.2.) This vulnerability can allow an attacker with authenticated access to trick SAML systems into authenticating as a different user without knowledge of the victim users passwo

CVE-2017-1533 [MEDIUM] CWE-79 CVE-2017-1533: IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. This vulnerabilit IBM Security Access Manager Appliance 9.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 130675.

CVE-2016-3018 [MEDIUM] CWE-79 CVE-2016-3018: IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.