Ibm Security Verify Access vulnerabilities

CVE-2024-31883 [MEDIUM] CWE-703 CVE-2024-31883: IBM Security Verify Access 10.0.0.0 through 10.0.7.1, under certain configurations, could allow an u IBM Security Verify Access 10.0.0.0 through 10.0.7.1, under certain configurations, could allow an unauthenticated attacker to cause a denial of service due to asymmetric resource consumption. IBM X-Force ID: 287615.

CVE-2019-4552 [MEDIUM] CVE-2019-4552: IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP respo IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked. This would allow the attacker to perform further attacks, such as Web cache poisoning,

CVE-2024-40700 [MEDIUM] CWE-79 CVE-2024-40700: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVE-2026-4364 [MEDIUM] CWE-79 CVE-2026-4364: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 allows certificate listings retrieved via a browser session to return a JSON payload while incorrectly specifying the response Con

CVE-2026-2475 [MEDIUM] CWE-601 CVE-2026-2475: IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10 IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability. An attacker could exploit th

CVE-2021-20585 [MEDIUM] CWE-200 CVE-2021-20585: IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that co IBM Security Verify Access 20.07 could disclose sensitive information in HTTP server headers that could be used in further attacks against the system. IBM X-Force ID: 199398.

CVE-2021-20498 [MEDIUM] CWE-200 CVE-2021-20498: IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be IBM Security Verify Access Docker 10.0.0 reveals version information in HTTP requests that could be used in further attacks against the system. IBM X-Force ID: 197972.

CVE-2021-38956 [MEDIUM] CWE-200 CVE-2021-38956: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in H IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 could disclose sensitive version information in HTTP response headers that could aid in further attacks against the system. IBM X-Force ID: 212038

CVE-2023-38267 [MEDIUM] CWE-311 CVE-2023-38267: IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6. IBM Security Access Manager Appliance (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 260584.

CVE-2024-28772 [MEDIUM] CWE-79 CVE-2024-28772: IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulne IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 2856

CVE-2022-43868 [MEDIUM] CWE-200 CVE-2022-43868: IBM Security Verify Access OIDC Provider could disclose directory information that could aid attacke IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID: 239445.

CVE-2023-31001 [MEDIUM] CWE-257 CVE-2023-31001: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.6.1) temporarily stores sensitive information in files that could be accessed by a local user. IBM X-Force ID: 254653.

CVE-2022-22370 [MEDIUM] CWE-79 CVE-2022-22370: IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site sc IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and 10.0.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 221194.

CVE-2023-30433 [MEDIUM] CWE-601 CVE-2023-30433: IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an IBM Security Verify Access 10.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could all

CVE-2023-32329 [MEDIUM] CWE-345 CVE-2023-32329: IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6. IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) could allow a user to download files from an incorrect repository due to improper file validation. IBM X-Force ID: 254972.

CVE-2024-25027 [MEDIUM] CWE-311 CVE-2024-25027: IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encry IBM Security Verify Access 10.0.6 could disclose sensitive snapshot information due to missing encryption. IBM X-Force ID: 281607.

CVE-2024-45658 [MEDIUM] CWE-209 CVE-2024-45658: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attack IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVE-2024-45659 [MEDIUM] CWE-209 CVE-2024-45659: IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attack IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned. This information could be used in further attacks against the system.

CVE-2026-8861 [MEDIUM] CWE-209 CVE-2026-8861: IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed te IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.

CVE-2021-38895 [MEDIUM] CWE-79 CVE-2021-38895: IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulne IBM Security Verify 10.0.0, 10.0.1.0, and 10.0.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209563.