CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4244
https://notcve.org/view.php?id=CVE-2020-4244
IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration. IBM X-Force ID: 175422. IBM Security Identity Governance and Intelligence versión 5.2.6, podría permitir a un usuario no autorizado obtener información confidencial mediante la enumeración de usuarios. IBM X-Force ID: 175422. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175422 https://www.ibm.com/support/pages/node/6207907 •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4233
https://notcve.org/view.php?id=CVE-2020-4233
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session cookie in SSL mode. By intercepting its transmission within an HTTP session, an attacker could exploit this vulnerability to capture the cookie and obtain sensitive information. IBM X-Force ID: 175360. IBM Security Identity Governance and Intelligence versión 5.2.6, podría permitir a un atacante remoto obtener información confidencial, causada por el fallo al establecer el flag seguro para la cookie de sesión en el modo SSL. Al interceptar su transmisión dentro de una sesión HTTP, un atacante podría explotar esta vulnerabilidad para capturar la cookie y obtener información confidencial. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175360 https://www.ibm.com/support/pages/node/6207912 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4232
https://notcve.org/view.php?id=CVE-2020-4232
IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further attacks against the system. IBM X-Force ID: 175336. IBM Security Identity Governance and Intelligence versión 5.2.6, podría permitir a un atacante enumerar nombres de usuario para encontrar credenciales de inicio de sesión válidas que podrían ser usadas para intentar nuevos ataques contra el sistema. IBM X-Force ID: 175336. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175336 https://www.ibm.com/support/pages/node/6207906 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-4231
https://notcve.org/view.php?id=CVE-2020-4231
IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation. IBM X-Force ID: 175335. IBM Security Identity Governance and Intelligence versión 5.2.6, podría permitir a un atacante enumerar nombres de usuario para encontrar credenciales de inicio de sesión válidas que podrían ser usadas para intentar nuevos ataques contra el sistema. IBM X-Force ID: 175336. • https://exchange.xforce.ibmcloud.com/vulnerabilities/175335 https://www.ibm.com/support/pages/node/6207905 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1944
https://notcve.org/view.php?id=CVE-2018-1944
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386. IBM Security Identity Governance and Intelligence, en versiones 5.2 hasta la 5.2.4.1 Virtual Appliance, contiene credenciales embebidas, como una contraseña o una clave criptográfica, que emplea para su propia autenticación entrante, comunicación saliente hacia componentes externos o para cifrar datos internos. IBM X-Force ID: 153386. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153386 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-798: Use of Hard-coded Credentials •