Security Secret Server (Ibm) - vulnerabilities (CVEs)

25 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2021-09-14. Vendor: Ibm.

CVEs of Security Secret Server

CVE-2021-20508 - CVSS 4.3 (medium), 2021-09-14: IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2021-20582 - CVSS 5.3 (medium), 2021-09-14: IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have…
CVE-2021-20569 - CVSS 5.3 (medium), 2021-09-14: IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243.
CVE-2020-4841 - CVSS 5.9 (medium), 2020-12-21: IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport…
CVE-2020-4840 - CVSS 7.4 (high), 2020-12-21: IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a…
CVE-2020-4843 - CVSS 6.3 (medium), 2020-12-21: IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048.
CVE-2020-4842 - CVSS 4.9 (medium), 2020-12-21: IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2020-4340 - CVSS 4.3 (medium), 2020-09-23: IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180.
CVE-2020-4324 - CVSS 4.3 (medium), 2020-09-23: IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID:…
CVE-2020-4459 - CVSS 9.8 (critical), 2020-08-04: IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,…
CVE-2020-4322 - CVSS 4.3 (medium), 2020-06-24: IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web…
CVE-2020-4341 - CVSS 5.3 (medium), 2020-06-24: IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2020-4327 - CVSS 5.3 (medium), 2020-06-24: IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the…
CVE-2020-4413 - CVSS 5.9 (medium), 2020-06-24: IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport…
CVE-2020-4323 - CVSS 6.1 (medium), 2020-06-24: IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2020-4342 - CVSS 5.3 (medium), 2020-06-24: IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182.
CVE-2019-4640 - CVSS 9.8 (critical), 2020-02-19: IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which…
CVE-2019-4639 - CVSS 7.5 (high), 2020-01-28: IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM…
CVE-2019-4635 - CVSS 2.7 (low), 2020-01-28: IBM Security Secret Server 10.7 could allow a privileged user to perform unauthorized command injection due to imporoper input neutralization of special…
CVE-2019-4638 - CVSS 3.7 (low), 2020-01-28: IBM Security Secret Server 10.7 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive…
CVE-2019-4633 - CVSS 4.3 (medium), 2020-01-28: IBM Security Secret Server 10.7 could allow an attacker to obtain sensitive information due to an overly permissive CORS policy. IBM X-Force ID: 170007.
CVE-2019-4637 - CVSS 4.3 (medium), 2020-01-28: IBM Security Secret Server 10.7 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct…
CVE-2019-4632 - CVSS 6.1 (medium), 2020-01-28: IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus…
CVE-2019-4636 - CVSS 2.7 (low), 2020-01-28: IBM Security Secret Server 10.7 could disclose sensitive information to an authenticated user from generated error messages. IBM X-Force ID: 170013.
CVE-2019-4631 - CVSS 7.4 (high), 2020-01-28: IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a…