Ibm Security Secret Server
25 CVEs affecting Ibm Security Secret Server. Latest disclosed: 2021-09-14. Critical: 2, High: 1.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4459 | Critical | 9.8 | 2020-08-04 | IBM Security Verify Access 10.7 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, out… |
CVE-2019-4640 | Critical | 9.8 | 2020-02-19 | IBM Security Secret Server 10.7 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code which co… |
CVE-2019-4639 | High | 7.5 | 2020-01-28 | IBM Security Secret Server 10.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-… |
CVE-2020-4840 | Medium | 6.1 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2020-4323 | Medium | 6.1 | 2020-06-24 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4632 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus al… |
CVE-2019-4631 | Medium | 6.1 | 2020-01-28 | IBM Security Secret Server 10.7 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a spe… |
CVE-2020-4841 | Medium | 5.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |
CVE-2020-4413 | Medium | 5.9 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport S… |
CVE-2021-20582 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have acce… |
CVE-2021-20569 | Medium | 5.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow an attacker to enumerate usernames due to improper input validation. IBM X-Force ID: 199243. |
CVE-2020-4342 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could disclose sensitive information included in installation files to an unauthorized user. IBM X-Force ID: 178182. |
CVE-2020-4341 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4327 | Medium | 5.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2020-4842 | Medium | 4.9 | 2020-12-21 | IBM Security Secret Server 10.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browse… |
CVE-2021-20508 | Medium | 4.3 | 2021-09-14 | IBM Security Secret Server up to 11.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… |
CVE-2020-4843 | Medium | 4.3 | 2020-12-21 | IBM Security Secret Server 10.6 stores potentially sensitive information in config files that could be read by an authenticated user. IBM X-Force ID: 190048. |
CVE-2020-4340 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server prior to 10.9 could allow an attacker to bypass SSL security due to improper certificate validation. IBM X-Force ID: 178180. |
CVE-2020-4324 | Medium | 4.3 | 2020-09-23 | IBM Security Secret Server proir to 10.9 could allow a remote attacker to bypass security restrictions, caused by improper input validation. IBM X-Force ID: 17… |
CVE-2020-4322 | Medium | 4.3 | 2020-06-24 | IBM Security Secret Server 10.7 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site… |