CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1945
https://notcve.org/view.php?id=CVE-2018-1945
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387. IBM Security Identity and Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, podría permitir... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153387 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1947
https://notcve.org/view.php?id=CVE-2018-1947
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, es vulnerable a Cross-Site Scripting (XSS). Esta vulnerabil... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153427 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1948
https://notcve.org/view.php?id=CVE-2018-1948
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428. IBM Security Identity Governance and Intelligence, desde la versió... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153428 • CWE-384: Session Fixation •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1949
https://notcve.org/view.php?id=CVE-2018-1949
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, divulga información sensible a usuarios no autorizados. Esta información puede emplearse para ejecutar más ataques en el sistema. • https://exchange.xforce.ibmcloud.com/vulnerabilities/153429 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1950
https://notcve.org/view.php?id=CVE-2018-1950
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, genera un mensaje de error que incluye información sensible sobre su entorno, usuarios o datos asociados, todo lo cual se... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153430 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1944
https://notcve.org/view.php?id=CVE-2018-1944
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386. IBM Security Identity Governance and Intelligence, en versiones 5.2 hasta la 5.2.4.1 Virtual Appliance, contiene credenciales embebidas, como una contraseña o una clave criptográfica, que emplea pa... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153386 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1946
https://notcve.org/view.php?id=CVE-2018-1946
21 Feb 2019 — IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388. IBM Security Identity Governance and Intelligence, desde la versión 5.2 hasta la 5.2.4.1 Virtual Appliance, soporta que múltiples actores int... • https://exchange.xforce.ibmcloud.com/vulnerabilities/153388 • CWE-326: Inadequate Encryption Strength •
CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1411
https://notcve.org/view.php?id=CVE-2017-1411
06 Aug 2018 — IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 127399. IBM Security Identity Governance Virtual Appliance, desde la versión 5.2 hasta la 5.2.3.2, no requiere que los usuarios tengan contraseñas fuertes por defecto, lo que facilita que los atacantes comprometan las cuentas de usuario. IBM X-Force ID: 127399. • http://www.ibm.com/support/docview.wss?uid=swg22016869 • CWE-522: Insufficiently Protected Credentials •
CVSS: 4.3EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1412
https://notcve.org/view.php?id=CVE-2017-1412
06 Aug 2018 — IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated data. IBM X-Force ID: 127400. IBM Security Guardium Big Data Intelligence (SonarG) desde la versión 5.2 hasta la 5.2.3.2 genera un mensaje de error que incluye información sensible sobre su entorno, usuarios o datos asociados. IBM X-Force ID: 127400. • http://www.ibm.com/support/docview.wss?uid=swg22016869 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.7EPSS: 0%CPEs: 7EXPL: 0CVE-2017-1755
https://notcve.org/view.php?id=CVE-2017-1755
06 Aug 2018 — IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files that could be executed by the administrator. IBM X-Force ID: 135855. IBM Security Identity Governance Virtual Appliance desde la versión 5.2 hasta la 5.2.3.2 podría permitir que un atacante local inyecte comandos en archivos maliciosos que podrían ser ejecutados por el administrador. IBM X-Force ID: 135855. • http://www.ibm.com/support/docview.wss?uid=swg22016869 •