Security Identity Manager (Ibm) - vulnerabilities (CVEs)

43 CVEs, 0 in the last 30 days, 64 known versions, newest CVE from 2022-08-30. Vendor: Ibm.

CVEs of Security Identity Manager

CVE-2021-29864 - CVSS 6.8 (medium), 2022-08-30: IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim…
CVE-2020-4970 - CVSS 5.9 (medium), 2022-05-19: IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure…
CVE-2021-20488 - CVSS 7.5 (high), 2021-06-16: IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM…
CVE-2021-20483 - CVSS 6.5 (medium), 2021-06-16: IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated…
CVE-2021-29683 - CVSS 6.5 (medium), 2021-05-20: IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998.
CVE-2021-29688 - CVSS 7.5 (high), 2021-05-20: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2021-29682 - CVSS 5.3 (medium), 2021-05-20: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2021-29687 - CVSS 5.3 (medium), 2021-05-20: IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts.…
CVE-2021-29692 - CVSS 5.9 (medium), 2021-05-20: IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict…
CVE-2021-29686 - CVSS 8.8 (high), 2021-05-20: IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force…
CVE-2021-29691 - CVSS 7.5 (high), 2021-05-20: IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2019-4675 - CVSS 9.8 (critical), 2020-02-04: IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound…
CVE-2019-4674 - CVSS 6.8 (medium), 2020-02-04: IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL…
CVE-2019-4451 - CVSS 5.4 (medium), 2020-02-04: IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2019-4561 - CVSS 8.8 (high), 2019-11-20: IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By…
CVE-2018-1968 - CVSS 5.3 (medium), 2019-07-11: IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system.…
CVE-2019-4038 - CVSS 7.2 (high), 2019-02-04: IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing…
CVE-2018-1962 - CVSS 4 (medium), 2019-02-04: IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session…
CVE-2018-1970 - CVSS 7.1 (high), 2019-02-04: IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit…
CVE-2018-1959 - CVSS 7.8 (high), 2019-01-24: IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own…
CVE-2018-2019 - CVSS 7.1 (high), 2019-01-18: IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote…
CVE-2018-1967 - CVSS 6.1 (medium), 2019-01-14: IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI…
CVE-2018-1956 - CVSS 7.5 (high), 2019-01-14: IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise…
CVE-2018-1969 - CVSS 9.9 (critical), 2019-01-14: IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the…
CVE-2017-1405 - CVSS 4.9 (medium), 2018-06-08: IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity…
CVE-2018-1453 - CVSS 8.8 (high), 2018-06-08: IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically…
CVE-2014-6111 - CVSS 7.8 (high), 2018-04-20: IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before…
CVE-2014-6109 - CVSS 5.3 (medium), 2018-04-20: IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before…
CVE-2014-6108 - CVSS 5.9 (medium), 2018-04-20: IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before…
CVE-2014-6112 - CVSS 5.9 (medium), 2018-04-20: IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before…
CVE-2016-0335 - CVSS 8.8 (high), 2018-01-12: Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001…
CVE-2016-0336 - CVSS 5.4 (medium), 2018-01-12: Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows…
CVE-2017-1483 - CVSS 8.6 (high), 2017-09-28: IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users…
CVE-2017-1407 - CVSS 8.8 (high), 2017-09-28: IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By…
CVE-2017-1362 - CVSS 7.8 (high), 2017-09-25: IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801.
CVE-2014-6106 - CVSS 8.8 (high), 2017-09-18: Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of…
CVE-2016-9739 - CVSS 7.8 (high), 2017-02-01: IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user.
CVE-2014-6168 - CVSS 6 (medium), 2014-12-29: Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the…
CVE-2014-6110 - CVSS 2.1 (low), 2014-11-18: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sessions by leveraging…
CVE-2014-6107 - CVSS 4.3 (medium), 2014-11-18: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP…
CVE-2014-6105 - CVSS 4.3 (medium), 2014-11-18: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
CVE-2014-6098 - CVSS 5 (medium), 2014-11-18: IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request.
CVE-2014-6096 - CVSS 4.3 (medium), 2014-11-18: Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrary web script or…
CVE-2014-6095 - CVSS 5 (medium), 2014-11-18: Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified…
CVE-2014-0961 - CVSS 6 (medium), 2014-06-08: Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity…