CVSS: 4.3EPSS: 0%CPEs: 16EXPL: 0CVE-2016-3045
https://notcve.org/view.php?id=CVE-2016-3045
01 Feb 2017 — IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. IBM Security Access Manager para Web almacena información sensible en parámetros URL. Esto puede dar lugar a la divulgación de información si las partes no autorizadas tienen acceso a las URL a través de los registros del servidor, el encabezado referente o el historial del navegador. • http://www.ibm.com/support/docview.wss?uid=swg21995435 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 0CVE-2016-3046
https://notcve.org/view.php?id=CVE-2016-3046
01 Feb 2017 — IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacker to view information in the back-end database. IBM Security Access Manager para Web es vulnerable a la inyección SQL. Un atacante remoto podría enviar sentencias SQL especialmente manipuladas que podrían permitir al atacante ver información en back-end de la base de datos. • http://www.ibm.com/support/docview.wss?uid=swg21995527 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 0CVE-2016-3017
https://notcve.org/view.php?id=CVE-2016-3017
01 Feb 2017 — IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations. IBM Security Access Manager para Web podrían permitir a un atacante remoto obtener información sensible debido a errores de configuración de seguridad. • http://www.ibm.com/support/docview.wss?uid=swg21995519 • CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 8.1EPSS: 0%CPEs: 13EXPL: 0CVE-2016-3025
https://notcve.org/view.php?id=CVE-2016-3025
25 Nov 2016 — IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach. IBM Security Access Manager para Mobile 8.x en versiones anteriores a 8.0.1.4 IF3 y Security Access Manager 9.x en versiones anteriores a 9.0.1.0 IF5 no restringe adecuadamente intentos de inicio de sesión fallidos, lo que facilita a atacantes remotos obtener acc... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV89240 • CWE-254: 7PK - Security Features •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6076
https://notcve.org/view.php?id=CVE-2014-6076
18 Dec 2014 — IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site. IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 permite a atacantes remotos llevar a cabo ataques de clickjacking través de un sitio web modificado. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 • CWE-254: 7PK - Security Features •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6077
https://notcve.org/view.php?id=CVE-2014-6077
18 Dec 2014 — Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences. Vulnerabilidad de CSRF en IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 permite a atacantes remotos a robar la autent... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.1EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6078
https://notcve.org/view.php?id=CVE-2014-6078
18 Dec 2014 — IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack. IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 no tiene un periodo de bloqueo tras intentos fallidos de login, esto provoca que se... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 • CWE-284: Improper Access Control •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6080
https://notcve.org/view.php?id=CVE-2014-6080
18 Dec 2014 — SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 permite a usuarios remotos autenticados, ejecutar sentencias SQL arbitraria... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6082
https://notcve.org/view.php?id=CVE-2014-6082
18 Dec 2014 — IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (administration UI outage) via unspecified vectors. IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 permiten a usuarios autenticados remotos provocar una denegación de servicio (desconexión de la interfaz de administraci... • http://secunia.com/advisories/61945 •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2014-6083
https://notcve.org/view.php?id=CVE-2014-6083
18 Dec 2014 — IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session. IBM Security Access Manager for Mobile 8.x anterior a 8.0.1 y Security Access Manager for Web 7.x anterior a 7.0.0 FP10 y 8.x anterior a 8.0.1 permiten a atacantes remotos obtener información de cookies sensibles al capturar el tráfico de red durante una sesión HTTP. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •