Ibm Security Identity Manager
28 CVEs affecting Ibm Security Identity Manager. Latest disclosed: 2022-08-30. Critical: 2, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-4675 | Critical | 9.8 | 2020-02-04 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2018-1969 | Critical | 9.0 | 2019-01-14 | IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's… |
CVE-2021-29686 | High | 8.8 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to. IBM X-Force I… |
CVE-2019-4561 | High | 8.8 | 2019-11-20 | IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By… |
CVE-2018-1453 | High | 8.8 | 2018-06-08 | IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically p… |
CVE-2017-1407 | High | 8.8 | 2017-09-28 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending… |
CVE-2017-1483 | High | 8.6 | 2017-09-28 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users a… |
CVE-2017-1362 | High | 7.8 | 2017-09-25 | IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 126801. |
CVE-2021-29691 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2021-29688 | High | 7.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the br… |
CVE-2018-1970 | High | 7.1 | 2019-02-04 | IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit thi… |
CVE-2018-2019 | High | 7.1 | 2019-01-18 | IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker… |
CVE-2021-20488 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM S… |
CVE-2021-20483 | Medium | 6.5 | 2021-06-16 | IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote authenticated attacke… |
CVE-2021-29683 | Medium | 6.5 | 2021-05-20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 199998. |
CVE-2019-4038 | Medium | 6.2 | 2019-02-04 | IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing securi… |
CVE-2021-29864 | Medium | 6.1 | 2022-08-30 | IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to… |
CVE-2018-1967 | Medium | 6.1 | 2019-01-14 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu… |
CVE-2021-29692 | Medium | 5.9 | 2021-05-20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2018-1956 | Medium | 5.9 | 2019-01-14 | IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… |