Security
Headlines
HeadlinesLatestCVEs

Tag

#ibm

CVE-2018-2013: Security Bulletin: API Connect V2018 is impacted by sensitive information leak (CVE-2018-2013)

IBM API Connect 2018.1 through 2018.4.1.5 could disclose sensitive information to an unauthorized user that could aid in further attacks against the system. IBM X-Force ID: 155193.

CVE
Open in Source
#vulnerability#js#auth#ibm
CVE-2019-4377: IBM Sterling B2B Integrator information disclosure CVE-2019-4377 Vulnerability Report

IBM Sterling B2B Integrator 6.0.0.0 and 6.0.0.1 reveals sensitive information from a stack trace that could be used in further attacks against the system. IBM X-Force ID: 162803.

CVE-2019-4382: IBM API Connect information disclosure CVE-2019-4382 Vulnerability Report

IBM API Connect 5.0.0.0 through 5.0.8.6 could allow an unauthorized user to obtain sensitive information about the system users using specially crafted HTTP requests. IBM X-Force ID: 162162.

CVE-2019-4156: IBM Security Access Manager information disclosure CVE-2019-4156 Vulnerability Report

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572.

CVE-2019-4158: IBM Security Access Manager improper authentication CVE-2019-4158 Vulnerability Report

IBM Security Access Manager 9.0.1 through 9.0.6 does not prove that a user's identity is correct which can lead to the exposure of resources or functionality to unintended actors. IBM X-Force ID: 158574.

CVE-2019-4152: IBM Security Access Manager session fixation CVE-2019-4152 Vulnerability Report

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 158515.

CVE-2019-4153: Security Bulletin: Multiple Security Vulnerabilities fixed in IBM Security Access Manager Appliance

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 158517.

CVE-2019-4385: Security Bulletin: Password exposure via job log in IBM Spectrum Protect Plus (CVE-2019-4385)

IBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.

CVE-2019-4384: IBM Campaign directory traversal CVE-2019-4384 Vulnerability Report

IBM Campaign 9.1.2 and 10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 162172.

CVE-2017-1107: IBM Marketing Platform information disclosure CVE-2017-1107 Vulnerability Report

IBM Marketing Platform 9.1.0, 9.1.2, 10.0, and 10.1 exposes sensitive information in the headers that could be used by an authenticated attacker in further attacks against the system. IBM X-Force ID: 120906.