Latest ibm security access manager Vulnerabilities

● CVE-2021-20439

IBM Security Access Manager Docker stores user credentials in plain clear text which can be read by an unauthorized user.

IBM Security Verify Access Docker<=10.0.0

IBM ISAM<=9.0

IBM Security Access Manager=9.0

IBM Security Verify Access=10.0.0

● CVE-2020-4499

IBM Security Access Manager Appliance could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to applications.

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

IBM Security Access Manager>=9.0.7.0<9.0.7.2

IBM Security Verify Access>=10.0.0<10.0.0.1

● CVE-2020-4699

IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.

IBM ISAM<=9.0.7

IBM ISVA<=10.0.0

IBM Security Access Manager=9.0.7.0

IBM Security Verify Access=10.0.0

● CVE-2020-4660

IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.

IBM ISAM<=9.0.7

IBM ISVA<=10.0.0

IBM Security Access Manager=9.0.7.0

IBM Security Verify Access=10.0.0

● CVE-2019-4552

IBM Security Access Manager Appliance is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a s...

IBM ISAM<=9.0.7

IBM Security Verify Access<=10.0.0

IBM Security Access Manager>=9.0.7.0<9.0.7.2

IBM Security Verify Access>=10.0.0<10.0.0.1

● CVE-2020-4661

IBM Security Access Manager Appliance could allow an attacker to obtain sensitive using timing side channel attacks which could aid in further attacks against the system.

IBM ISAM<=9.0.7

IBM ISVA<=10.0.0

IBM Security Access Manager=9.0.7.0

IBM Security Verify Access=10.0.0

● CVE-2019-4725

IBM Security Access Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

IBM ISAM<=9.0

IBM Security Access Manager>=9.0.0.0<9.0.7.0

● CVE-2020-4461

IBM Security Access Manager could allow an authenticated user to bypass security by allowing id_token claims manipulation without verification.

IBM ISAM<=9.0

IBM Security Access Manager>=9.0<9.0.7.1

● CVE-2019-4707

IBM Security Access Manager=9.0.7.0

IBM ISAM<=9.0

● CVE-2019-4036

IBM Security Access Manager Appliance could allow unauthenticated attacker to cause a denial of service in the reverse proxy component.

IBM Security Access Manager

● CVE-2019-4151

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158512.

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4145

IBM Security Access Manager 9.0.1 through 9.0.6 could reveal highly sensitive in specialized conditions to a local user which could be used in further attacks against the system. IBM X-Force ID: 15840...

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4157

IBM Security Access Manager 9.0.1 through 9.0.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended funct...

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4153

IBM Security Access Manager 9.0.1 through 9.0.6 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, ...

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4158

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4152

IBM Security Access Manager 9.0.1 through 9.0.6 does not invalidate session tokens in a timely manner. The lack of proper session expiration may allow attackers with local access to login into a close...

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2019-4156

IBM Security Access Manager 9.0.1 through 9.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 158572.

IBM Security Access Manager>=9.0.1<=9.0.6

● CVE-2018-1970

IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive infor...

IBM Security Access Manager>=7.0.1<=7.0.1.10

● CVE-2018-1887

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authen...