Unscored severity · published Dec 18, 2014
CVE-2014-6078
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid…
–
CVSS
1.4%
EPSS
No
On KEV
Description
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SA
Security Access Manager For Mobile · Ibm
8.0 · source: NVD
SA
Security Access Manager For Web · Ibm
7.0; 8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-6078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-6078
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21684475
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/95762
More from Security Access Manager For Mobile
8.1
CVE-2016-3025
IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it…
7.5
CVE-2017-1473
IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt…
7.5
CVE-2016-5919
IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
6.1
CVE-2017-1534
IBM Security Access Manager Appliance 8.0.0 and 9.0.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack
6.1
CVE-2017-1489
IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability