CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1368
https://notcve.org/view.php?id=CVE-2017-1368
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 126861. IBM Security Identity Governance Virtual Appliance, desde la versión 5.2 hasta la 5.2.3.2, no establece el atributo secure en los tokens de autorización o las cookies de sesión. • http://www.ibm.com/support/docview.wss?uid=swg22016869 https://exchange.xforce.ibmcloud.com/vulnerabilities/126861 • CWE-384: Session Fixation •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1409
https://notcve.org/view.php?id=CVE-2017-1409
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 127396. IBM Security Identity Governance y Intelligence Virtual Appliance desde la versión 5.2 hasta la 5.2.3.2 revela información sensible a usuarios no autorizados. Esta información puede emplearse para ejecutar más ataques en el sistema. • http://www.ibm.com/support/docview.wss?uid=swg22016869 https://exchange.xforce.ibmcloud.com/vulnerabilities/127396 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1411
https://notcve.org/view.php?id=CVE-2017-1411
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399. IBM Security Identity Governance Virtual Appliance, desde la versión 5.2 hasta la 5.2.3.2, no requiere que los usuarios tengan contraseñas fuertes por defecto, lo que facilita que los atacantes comprometan las cuentas de usuario. IBM X-Force ID: 127399. • http://www.ibm.com/support/docview.wss?uid=swg22016869 https://exchange.xforce.ibmcloud.com/vulnerabilities/127399 • CWE-522: Insufficiently Protected Credentials •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1412
https://notcve.org/view.php?id=CVE-2017-1412
IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400. IBM Security Guardium Big Data Intelligence (SonarG) desde la versión 5.2 hasta la 5.2.3.2 genera un mensaje de error que incluye información sensible sobre su entorno, usuarios o datos asociados. IBM X-Force ID: 127400. • http://www.ibm.com/support/docview.wss?uid=swg22016869 https://exchange.xforce.ibmcloud.com/vulnerabilities/127400 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1367
https://notcve.org/view.php?id=CVE-2017-1367
IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history. IBM X-Force ID: 126860. IBM Security Identity Governance y Intelligence Virtual Appliance desde la versión 5.2 hasta la 5.2.3.2 almacena información sensible en parámetros URL. Esto podría llevar a una divulgación de información si partes no autorizadas tienen acceso a las URL mediante registros del servidor, cabeceras referrer o el historial del navegador. • http://www.ibm.com/support/docview.wss?uid=swg22016869 https://exchange.xforce.ibmcloud.com/vulnerabilities/126860 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •