Page 8 of 106 results (0.009 seconds)

CVSS: 4.0EPSS: 0%CPEs: 5EXPL: 0

CVE-2016-3046

https://notcve.org/view.php?id=CVE-2016-3046

01 Feb 2017 — IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacker to view information in the back-end database. IBM Security Access Manager para Web es vulnerable a la inyección SQL. Un atacante remoto podría enviar sentencias SQL especialmente manipuladas que podrían permitir al atacante ver información en back-end de la base de datos. • http://www.ibm.com/support/docview.wss?uid=swg21995527 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 0%CPEs: 38EXPL: 0

CVE-2016-3017

https://notcve.org/view.php?id=CVE-2016-3017

01 Feb 2017 — IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations. IBM Security Access Manager para Web podrían permitir a un atacante remoto obtener información sensible debido a errores de configuración de seguridad. • http://www.ibm.com/support/docview.wss?uid=swg21995519 • CWE-358: Improperly Implemented Security Check for Standard •

CVSS: 8.1EPSS: 0%CPEs: 13EXPL: 0

CVE-2016-3025

https://notcve.org/view.php?id=CVE-2016-3025

25 Nov 2016 — IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote attackers to obtain access via a brute-force approach. IBM Security Access Manager para Mobile 8.x en versiones anteriores a 8.0.1.4 IF3 y Security Access Manager 9.x en versiones anteriores a 9.0.1.0 IF5 no restringe adecuadamente intentos de inicio de sesión fallidos, lo que facilita a atacantes remotos obtener acc... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV89240 • CWE-254: 7PK - Security Features •

CVSS: 9.1EPSS: 0%CPEs: 12EXPL: 0

CVE-2016-3028

https://notcve.org/view.php?id=CVE-2016-3028

25 Nov 2016 — IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access. IBM Security Access Manager para Web 7.0 en versiones anteriores a IF2 y 8.0 en versiones anteriores a 8.0.1.4 IF3 y Security Access Manager 9.0 en versiones anteriores a 9.0.1.0 IF5 permiten a usuarios remotos autenticados ejecutar comandos arbitrarios aprovechando el acceso de administ... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV89257 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0

CVE-2015-8531

https://notcve.org/view.php?id=CVE-2015-8531

15 Feb 2016 — Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. Vulnerabilidad de XSS en IBM Security Access Manager for Web 8.0 en versiones anteriores a 8.0.1.3 IF4 y 9.0 en versiones anteriores a 9.0.0.1 IF1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de una URL manipulada. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV80692 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.5EPSS: 0%CPEs: 29EXPL: 0

CVE-2015-5010

https://notcve.org/view.php?id=CVE-2015-5010

15 Feb 2016 — IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack. IBM Security Access Manager for Web 7.0 en versiones anteriores a 7.0.0 IF21, 8.0 en versiones anteriores a 8.0.1.3 IF4 y 9.0 en versiones anteriores a 9.0.0.1 IF1 no tiene un mecanismo de bloqueo para intentos de inicio de sesión no válidos, lo que faci... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV80694 • CWE-254: 7PK - Security Features •

CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0

CVE-2015-5012

https://notcve.org/view.php?id=CVE-2015-5012

15 Feb 2016 — The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors. La implementación de SSH en IBM Security Access Manager for Web appliances 7.0 en versiones anteriores a 7.0.0 FP19, 8.0 en versiones anteriores a 8.0.1.3 IF3 y 9.0 en versiones anteriores a 9.0.0.... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV78768 • CWE-310: Cryptographic Issues •

CVSS: 8.5EPSS: 1%CPEs: 25EXPL: 0

CVE-2015-5018

https://notcve.org/view.php?id=CVE-2015-5018

02 Jan 2016 — IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access. IBM Security Access Manager for Web 7.0.0 en versiones anteriores a FP19 y 8.0 en versiones anteriores a 8.0.1.3 IF3 y Security Access Manager 9.0 en versiones anteriores a 9.0.0.0 IF1, permite a usuarios remotos autenticados ejecutar comandos del SO arbit... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV78768 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •

CVSS: 9.1EPSS: 1%CPEs: 26EXPL: 0

CVE-2015-4963

https://notcve.org/view.php?id=CVE-2015-4963

08 Nov 2015 — IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via unspecified vectors. IBM Security Access Manager for Web 7.x en versiones anteriores a 7.0.0.16 y 8.x en versiones anteriores a 8.0.1.3 no maneja correctamente las peticiones WebSEAL HTTPTransformation, lo que permite a atacantes remotos leer o escribir a archivos arbitrarios a través de vectores no especificados. • http://www-01.ibm.com/support/docview.wss?uid=swg1IV71196 • CWE-17: DEPRECATED: Code •

CVSS: 9.1EPSS: 2%CPEs: 7EXPL: 0

CVE-2015-1892

https://notcve.org/view.php?id=CVE-2015-1892

01 Apr 2015 — The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. El contestador Multicast DNS (mDNS) en IBM Security Access Manager for Web 7.x anterior a 7.0.0 FP12 y 8.x anterior a 8.0.1 FP1 responde inadvertida... • http://www-01.ibm.com/support/docview.wss?uid=swg1IV70911 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •