CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1946
https://notcve.org/view.php?id=CVE-2018-1946
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, soporta que múltiples actores interactúen entre ellos y les permite negociar qué algoritmo se debería utilizar como mecanismo de protección (por ejemplo, el cifrado o la autenticación), pero no selecciona el algoritmo más robusto que esté disponible para ambas partes. IBM X-Force ID: 153388. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153388 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-326: Inadequate Encryption Strength •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1947
https://notcve.org/view.php?id=CVE-2018-1947
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabilidad permite que los usuarios embeban código JavaScript arbitrario en la interfaz de usuario web, lo que altera las funcionalidades previstas. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153427 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1944
https://notcve.org/view.php?id=CVE-2018-1944
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386. IBM Security Identity Governance and Intelligence, en versiones 5.2 hasta la 5.2.4.1 Virtual Appliance, contiene credenciales embebidas, como una contraseña o una clave criptográfica, que emplea para su propia autenticación entrante, comunicación saliente hacia componentes externos o para cifrar datos internos. IBM X-Force ID: 153386. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153386 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-798: Use of Hard-coded Credentials •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1948
https://notcve.org/view.php?id=CVE-2018-1948
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, no establece el atributo seguro en tokens de autorización o en cookies de sesión. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153428 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1949
https://notcve.org/view.php?id=CVE-2018-1949
IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, divulga información sensible a usuarios no autorizados. Esta información puede emplearse para ejecutar más ataques en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153429 https://www.ibm.com/support/docview.wss?uid=ibm10872142 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •