CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1948
https://notcve.org/view.php?id=CVE-2018-1948
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, no establece el atributo seguro en tokens de autorización o en cookies de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153428 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1949
https://notcve.org/view.php?id=CVE-2018-1949
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, divulga información sensible a usuarios no autorizados. Esta información puede emplearse para ejecutar más ataques en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153429 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1947
https://notcve.org/view.php?id=CVE-2018-1947
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153427 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1946
https://notcve.org/view.php?id=CVE-2018-1946
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, soporta que múltiples actores interactúen entre ellos y les permite negociar qué algoritmo se debería utilizar como mecanismo de protección (por ejemplo, el cifrado o la autenticación), pero no selecciona el algoritmo más robusto que esté disponible para ambas partes. IBM X-Force ID: 153388. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153388 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-326: Inadequate Encryption Strength •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1950
https://notcve.org/view.php?id=CVE-2018-1950
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, genera un mensaje de error que incluye información sensible sobre su entorno, usuarios o datos asociados, todo lo cual se podría usar en futuros ataques contra el sistema, IBM X-Force ID: 153430. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153430 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •