CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1945
https://notcve.org/view.php?id=CVE-2018-1945
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387. IBM Security Identity and Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, podría permitir que un atacante remoto secuestre la acción de clicado de la víctima. Al persuadir a una víctima para que visite un sitio web malicioso, un atacante remoto podría explotar esta vulnerabilidad para secuestrar las acciones de clicado de la víctima y, probablemente, lanzar más ataques contra la víctima. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153387 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1946
https://notcve.org/view.php?id=CVE-2018-1946
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, soporta que múltiples actores interactúen entre ellos y les permite negociar qué algoritmo se debería utilizar como mecanismo de protección (por ejemplo, el cifrado o la autenticación), pero no selecciona el algoritmo más robusto que esté disponible para ambas partes. IBM X-Force ID: 153388. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153388 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-326: Inadequate Encryption Strength •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1947
https://notcve.org/view.php?id=CVE-2018-1947
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153427 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1944
https://notcve.org/view.php?id=CVE-2018-1944
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386. IBM Security Identity Governance and Intelligence, en versiones 5.2 hasta la 5.2.4.1 Virtual Appliance, contiene credenciales embebidas, como una contraseña o una clave criptográfica, que emplea para su propia autenticación entrante, comunicación saliente hacia componentes externos o para cifrar datos internos. IBM X-Force ID: 153386. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153386 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1948
https://notcve.org/view.php?id=CVE-2018-1948
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, no establece el atributo seguro en tokens de autorización o en cookies de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153428 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-384: Session Fixation •