DR
Product
Data Risk Manager
On CISA KEVExploited in the wild
18
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 8Medium 7Low 0
Watch
Add Data Risk Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4427 In wildKEV | 9.8 | May 7 | IBM Data Risk Manager Security Bypass Vulnerability Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6 |
| CVE-2020-4428 In wildKEV | 9.1 | May 7 | IBM Data Risk Manager Remote Code Execution Vulnerability Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6 |
| CVE-2020-4430 In wildKEV | 4.3 | May 7 | IBM Data Risk Manager Directory Traversal Vulnerability Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6 |
| CVE-2020-4429 | 9.8 | May 7 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account Affected: 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; 2.0.6 |
| CVE-2020-4621 | 8.8 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient authorization checks Affected: before 2.0.6.4 |
| CVE-2020-4620 | 8.8 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions Affected: before 2.0.6.4 |
| CVE-2020-4611 | 8.8 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to bypass security and execute actions reserved for admins Affected: before 2.0.6.4 |
| CVE-2020-4617 | 8.1 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user… Affected: before 2.0.6.4 |
| CVE-2021-38862 | 7.5 | Oct 12 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 2.0.6 |
| CVE-2020-4622 | 7.5 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… Affected: before 2.0.6.4 |
| CVE-2020-4614 | 7.5 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information Affected: before 2.0.6.4 |
| CVE-2020-4613 | 7.5 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: before 2.0.6.4 |
| CVE-2021-38915 | 6.5 | Oct 12 | IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user Affected: 2.0.6 |
| CVE-2020-4619 | 6.5 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user Affected: before 2.0.6.4 |
| CVE-2020-4612 | 6.5 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to obtain sensitive information using a specially crafted HTTP request Affected: before 2.0.6.4 |
| CVE-2020-4615 | 5.4 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 is vulnerable to cross-site scripting Affected: before 2.0.6.4 |
| CVE-2020-4616 | 5.3 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could disclose sensitive username information to an attacker using a specially crafted HTTP request Affected: before 2.0.6.4 |
| CVE-2020-4618 | 4.9 | Sep 22 | IBM Data Risk Manager (iDNA) 2.0.6 could allow a privileged user to cause a denial of service due to improper input validation Affected: before 2.0.6.4 |
Showing 18