CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2011-3135
https://notcve.org/view.php?id=CVE-2011-3135
Unspecified vulnerability in the Runtime in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors. Vulnerabilidad no especificada en el Runtime en IBM Tivoli Federated Identity Manager (TFIM) v6.2.0 anterior a v6.2.0.9 y Tivoli Federated Identity Manager Business Gateway (TFIMBG) v6.2.0 anterior a v6.2.0.9 tiene un impacto desconocido y vectores de ataque. • http://secunia.com/advisories/45555 http://www-01.ibm.com/support/docview.wss?uid=swg1IV03074 http://www.ibm.com/support/docview.wss?uid=swg24029497 http://www.ibm.com/support/docview.wss?uid=swg24029498 https://exchange.xforce.ibmcloud.com/vulnerabilities/69205 •
CVSS: 5.0EPSS: 0%CPEs: 10EXPL: 0CVE-2011-3138
https://notcve.org/view.php?id=CVE-2011-3138
The LTPA STS module support implementation in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 relies on a static instance of a Java Development Kit (JDK) class, which might allow attackers to bypass LTPA token signature verification by leveraging lack of thread safety. El módulo de LTPA STS en IBM Tivoli Federated Identity Manager (TFIM) v6.2.0 anterior a v6.2.0.9 y Tivoli Federated Identity Manager Business Gateway (TFIMBG) v6.2.0 anterior a v6.2.0.9 se basa en una instancia estática de una clase Java Development Kit (JDK), lo que podría permitir a un atacante eludir la verificación de token de firma LTPA aprovechando la falta de seguridad de los subprocesos. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV01318 http://www.ibm.com/support/docview.wss?uid=swg24029497 http://www.ibm.com/support/docview.wss?uid=swg24029498 https://exchange.xforce.ibmcloud.com/vulnerabilities/69198 •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-5083
https://notcve.org/view.php?id=CVE-2009-5083
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when configured as an OpenID relying party, does not perform the expected login rejection upon receiving an OP-Identifier from an OpenID provider, which allows remote attackers to bypass authentication via unspecified vectors. IBM Tivoli Federated Identity Manager (TFIM) v6.2.0 anterior a v6.2.0.2 cuando es configurado en una entidad de confianza OpenID, no desarrolla un rechazo de registro hasta recibir un OP-Identifier de un proveedor OpenID, lo que permite a atacantes remotos evitar autencación a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44571 http://www.ibm.com/support/docview.wss?uid=swg24029497 • CWE-287: Improper Authentication •
CVSS: 1.9EPSS: 0%CPEs: 2EXPL: 0CVE-2009-5084
https://notcve.org/view.php?id=CVE-2009-5084
IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.2, when com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate tracing is enabled, creates a cleartext log entry containing a password, which might allow local users to obtain sensitive information by reading the log data. IBM Tivoli Federated Identity Manager (TFIM) v6.2.0 anterior a v6.2.0.2, cuando las trazas com.tivoli.am.fim.infocard.delegates.InfoCardSTSDelegate están habilitadas, crea una entrada en el log en texto plano que contiene una contraseña, permite a usuarios locales obtener información sensible leyendo ese dato del log. • http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44560 http://www.ibm.com/support/docview.wss?uid=swg24029497 • CWE-310: Cryptographic Issues •
CVSS: 10.0EPSS: 0%CPEs: 10EXPL: 0CVE-2011-3136
https://notcve.org/view.php?id=CVE-2011-3136
Unspecified vulnerability in the Management Console in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.9 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.9 has unknown impact and attack vectors, aka APAR IV03048. Vulnerabilidad no especificada en la consola de administración de IBM Tivoli Federated Identity Manager (TFIM) v6.2.0 anterior v6.2.0.9 y Tivoli Federated Identity Business Gateway Manager (TFIMBG) v6.2.0 anterior a v6.2.0.9 tiene un impacto y un vector de ataque desconocido, también conocido como APAR IV03048. • http://secunia.com/advisories/45555 http://www-01.ibm.com/support/docview.wss?uid=swg1IV03048 http://www.ibm.com/support/docview.wss?uid=swg24029497 http://www.ibm.com/support/docview.wss?uid=swg24029498 •