CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 1CVE-2024-35133 – IBM Security Verify Access HTTP open redirect
https://notcve.org/view.php?id=CVE-2024-35133
IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. • https://github.com/Ozozuz/Ozozuz-IBM-Security-Verify-CVE-2024-35133 https://exchange.xforce.ibmcloud.com/vulnerabilities/291026 https://www.ibm.com/support/pages/node/7166712 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35139 – IBM Security Access Manager Docker information disclosure
https://notcve.org/view.php?id=CVE-2024-35139
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415. IBM Security Access Manager Docker 10.0.0.0 a 10.0.7.1 podría permitir que un usuario local obtenga información confidencial del contenedor debido a permisos predeterminados incorrectos. ID de IBM X-Force: 292415. • https://exchange.xforce.ibmcloud.com/vulnerabilities/292415 https://www.ibm.com/support/pages/node/7158790 • CWE-276: Incorrect Default Permissions •
CVSS: 6.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35137 – IBM Security Access Manager Docker information disclosure
https://notcve.org/view.php?id=CVE-2024-35137
IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: 292413. IBM Security Access Manager Docker 10.0.0.0 a 10.0.7.1 podría permitir que un usuario local posiblemente eleve sus privilegios debido a la exposición de información de configuración confidencial. ID de IBM X-Force: 292413. • https://exchange.xforce.ibmcloud.com/vulnerabilities/292413 https://www.ibm.com/support/pages/node/7158790 • CWE-258: Empty Password in Configuration File •
CVSS: 8.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35142 – IBM Security Verify Access privilege escalation
https://notcve.org/view.php?id=CVE-2024-35142
IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to execution of unnecessary privileges. IBM X-Force ID: 292418. IBM Security Verify Access Docker 10.0.0 a 10.0.6 podría permitir que un usuario local escale sus privilegios debido a la ejecución de privilegios innecesarios. ID de IBM X-Force: 292418. • https://exchange.xforce.ibmcloud.com/vulnerabilities/292418 https://www.ibm.com/support/pages/node/7155356 • CWE-250: Execution with Unnecessary Privileges •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-35140 – IBM Security Verify Access privilege escalation
https://notcve.org/view.php?id=CVE-2024-35140
IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Force ID: 292416. IBM Security Verify Access Docker 10.0.0 a 10.0.6 podría permitir que un usuario local escale sus privilegios debido a una validación de certificado incorrecta. ID de IBM X-Force: 292416. • https://exchange.xforce.ibmcloud.com/vulnerabilities/292416 https://www.ibm.com/support/pages/node/7155356 • CWE-295: Improper Certificate Validation •