CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-29864
https://notcve.org/view.php?id=CVE-2021-29864
IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 206089 IBM Security Identity Manager versiones 6.0 y 6.0.2, podría permitir a un atacante remoto conducir ataques de suplantación de identidad, usando un ataque de redireccionamiento abierto. Al persuadir a una víctima para que visite un sitio web especialmente diseñado, un atacante remoto podría explotar esta vulnerabilidad para falsificar la URL mostrada y redirigir al usuario a un sitio web malicioso que parecería ser confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/206089 https://www.ibm.com/support/pages/node/6616101 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-4451
https://notcve.org/view.php?id=CVE-2019-4451
IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 163493. IBM Security Identity Manager versión 6.0.0, presenta una vulnerabilidad de tipo cross-site scripting. Esta vulnerabilidad permite a usuarios insertar código JavaScript arbitrario en la Interfaz de Usuario Web, alterando así la funcionalidad prevista que puede conllevar a una divulgación de credenciales dentro de una sesión confiable. • https://exchange.xforce.ibmcloud.com/vulnerabilities/163493 https://www.ibm.com/support/pages/node/1288720 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2019-4038
https://notcve.org/view.php?id=CVE-2019-4038
IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162. IBM Security Identity Manager 6.0 y 7.0 podría permitir que un atacante cree rutas de flujo de control mediante la aplicación, pudiendo omitir las comprobaciones de seguridad. La explotación de esta vulnerabilidad puede resultar en una forma limitada de inyección de código. • https://exchange.xforce.ibmcloud.com/vulnerabilities/156162 https://www.ibm.com/support/docview.wss?uid=ibm10869604 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.1EPSS: 0%CPEs: 13EXPL: 0CVE-2018-2019
https://notcve.org/view.php?id=CVE-2018-2019
IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 155265. La versión 6.0.0 de IBM Security Identity Manager es vulnerable a ataques del tipo XML External Entity Injection (XXE) al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad para exponer información sensible o consumir recursos de la memoria. • http://www.securityfocus.com/bid/106657 https://exchange.xforce.ibmcloud.com/vulnerabilities/155265 https://www.ibm.com/support/docview.wss?uid=ibm10794615 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1956
https://notcve.org/view.php?id=CVE-2018-1956
IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628. La versión 6.0.0 de IBM Security Identity Manager no requiere que los usuarios tengan contraseñas fuertes por defecto, lo que facilita que los atacantes comprometan las cuentas de usuario. IBM X-Force ID: 153628. • http://www.securityfocus.com/bid/106554 https://exchange.xforce.ibmcloud.com/vulnerabilities/153628 https://www.ibm.com/support/docview.wss?uid=ibm10794615 • CWE-521: Weak Password Requirements •