CVSS: 8.8EPSS: 0%CPEs: 21EXPL: 0CVE-2016-3029
https://notcve.org/view.php?id=CVE-2016-3029
IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM Security Access Manager para Web es vulnerable a la falsificación de solicitudes de sitios cruzados que podrían permitir a un atacante ejecutar acciones maliciosas y no autorizadas transmitidas por un usuario que confía en el sitio web. • http://www.ibm.com/support/docview.wss?uid=swg21995345 http://www.securityfocus.com/bid/96133 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.9EPSS: 0%CPEs: 7EXPL: 0CVE-2016-3043
https://notcve.org/view.php?id=CVE-2016-3043
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Security Access Manager para Web podría permitir a un atacante remoto obtener información sensible, causada por el error de habilitar correctamente HTTP Strict Transport Security. Un atacante podría explotar esta vulnerabilidad para obtener información sensible utilizando técnicas man-in-the-middle. • http://www.ibm.com/support/docview.wss?uid=swg21995446 http://www.securityfocus.com/bid/95107 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.3EPSS: 0%CPEs: 38EXPL: 0CVE-2016-3023
https://notcve.org/view.php?id=CVE-2016-3023
IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names. IBM Security Access Manager para Web podría permitir a un usuario no autenticado obtener acceso a información sensible introduciendo nombres de archivo no válidos. • http://www.ibm.com/support/docview.wss?uid=swg21995348 http://www.securityfocus.com/bid/96124 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2015-8531
https://notcve.org/view.php?id=CVE-2015-8531
Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Security Access Manager for Web 8.0 en versiones anteriores a 8.0.1.3 IF4 y 9.0 en versiones anteriores a 9.0.0.1 IF1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV80692 http://www-01.ibm.com/support/docview.wss?uid=swg21974651 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 29EXPL: 0CVE-2015-5010
https://notcve.org/view.php?id=CVE-2015-5010
IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack. IBM Security Access Manager for Web 7.0 en versiones anteriores a 7.0.0 IF21, 8.0 en versiones anteriores a 8.0.1.3 IF4 y 9.0 en versiones anteriores a 9.0.0.1 IF1 no tiene un mecanismo de bloqueo para intentos de inicio de sesión no válidos, lo que facilita a atacantes remotos obtener acceso a través de un ataque de fuerza bruta. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV80694 http://www-01.ibm.com/support/docview.wss?uid=swg1IV80728 http://www-01.ibm.com/support/docview.wss?uid=swg21970508 • CWE-254: 7PK - Security Features •