CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5958
https://notcve.org/view.php?id=CVE-2016-5958
IBM Security Privileged Identity Manager could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM Security Privileged Identity Manager podrían permitir a un atacante remoto obtener información sensible, provocada por la falta para establecer el indicador seguro para la cookie de sesión en modo SSL. Al interceptar su transmisión dentro de una sesión HTTP, un atacante podría explotar esta vulnerabilidad para capturar la cookie y obtener información sensible. • http://www.ibm.com/support/docview.wss?uid=swg21996614 http://www.securityfocus.com/bid/95196 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.9EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5966
https://notcve.org/view.php?id=CVE-2016-5966
IBM Security Privileged Identity Manager Virtual Appliance could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Security Privileged Identity Manager Virtual Appliance podría permitir a un atacante remoto obtener información sensible, causada por el error para habilitar correctamente HTTP Strict Transport Security. Un atacante podría explotar esta vulnerabilidad para obtener información sensible utilizando técnicas man-in-the-middle. • http://www.ibm.com/support/docview.wss?uid=swg21996614 http://www.securityfocus.com/bid/95197 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-5964
https://notcve.org/view.php?id=CVE-2016-5964
IBM Security Privileged Identity Manager Virtual Appliance version 2.0.2 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM Security Privileged Identity Manager Virtual Appliance versión 2.0.2 utiliza una configuración de bloqueo de cuentas inadecuada que podría permitir a un atacante remoto para credenciasles de cuenta por fuerza bruta. • http://www.ibm.com/support/docview.wss?uid=swg21994065 http://www.securityfocus.com/bid/94308 • CWE-284: Improper Access Control •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2016-5988
https://notcve.org/view.php?id=CVE-2016-5988
IBM Security Privileged Identity Manager Virtual Appliance could disclose sensitive information in generated error messages that would be available to an authenticated user. IBM Security Privileged Identity Manager Virtual Appliance podría revelar información sensible en mensajes de error generados que estarían disponibles para un usuario autenticado. • http://www.ibm.com/support/docview.wss?uid=swg21996614 http://www.securityfocus.com/bid/95198 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-2996
https://notcve.org/view.php?id=CVE-2016-2996
IBM Security Privileged Identity Manager 2.0 before 2.0.2 FP8, when Virtual Appliance is used, allows remote authenticated users to append to arbitrary files via unspecified vectors. IBM Security Privileged Identity Manager 2.0 en versiones anteriores a 2.0.2 FP8, cuando se utiliza Virtual Appliance, permite a usuarios remotos autenticados añadir archivos arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg21988706 • CWE-20: Improper Input Validation •