SA
Product
Security Access Manager For Web 8.0 Firmware
On CISA KEVExploited in the wild
27
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 3High 6Medium 10Low 2
Watch
Add Security Access Manager For Web 8.0 Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-7169 In wildKEV | 9.8 | Sep 25 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: 8.0.0.2; 8.0.0.3; 8.0.0.5 |
| CVE-2014-6271 In wildKEV | 9.8 | Sep 24 | GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability Affected: 8.0.0.2; 8.0.0.3; 8.0.0.5 |
| CVE-2016-2908 | 9.1 | Feb 1 | IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2016-3029 | 8.8 | Feb 1 | IBM Security Access Manager for Web is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2015-5018 | 8.0 | Jan 2 | IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1; 8.0.1.0; +2 more |
| CVE-2016-5919 | 7.5 | Feb 16 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: All versions, or not specified |
| CVE-2016-3017 | 7.5 | Feb 1 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2015-5012 | 7.5 | Feb 15 | The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1; 8.0.1.0; +1 more |
| CVE-2015-5010 | 7.5 | Feb 15 | IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1; 8.0.1.0; +2 more |
| CVE-2016-3027 | 6.5 | Feb 1 | IBM Security Access Manager for Web is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2016-3022 | 6.5 | Feb 1 | IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2015-8531 | 6.1 | Feb 15 | Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1; 8.0.1.0; +1 more |
| CVE-2016-3043 | 5.9 | Feb 1 | IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: All versions, or not specified |
| CVE-2015-5013 | 5.5 | Feb 8 | The IBM Security Access Manager appliance includes configuration files that contain obfuscated plaintext-passwords which authenticated users can access Affected: All versions, or not specified |
| CVE-2016-3020 | 5.5 | Feb 7 | IBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 could allow a remote attacker to bypass security restrictions, caused by improper content validation Affected: All versions, or not specified |
| CVE-2016-3023 | 5.3 | Feb 1 | IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2016-3016 | 4.4 | Feb 1 | IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2017-1459 | 4.2 | Jan 10 | IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by… Affected: All versions, or not specified |
| CVE-2016-3024 | 4.0 | Feb 1 | IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2016-3046 | 2.7 | Feb 1 | IBM Security Access Manager for Web is vulnerable to SQL injection Affected: All versions, or not specified |
| CVE-2016-3021 | 2.7 | Feb 1 | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.5; 8.0.1.0; 8.0.1.2; +2 more |
| CVE-2015-1892 | – | Apr 1 | The Multicast DNS (mDNS) responder in IBM Security Access Manager for Web 7.x before 7.0.0 FP12 and 8.x before 8.0.1 FP1 inadvertently responds to unicast queries with source… Affected: 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; 8.0.1.0 |
| CVE-2014-6079 | – | Oct 3 | Cross-site scripting (XSS) vulnerability in the Local Management Interface in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before… Affected: 8.0.0.2; 8.0.0.3; 8.0.0.4 |
| CVE-2014-4823 | – | Oct 3 | The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x… Affected: 8.0.0.2; 8.0.0.3; 8.0.0.4 |
| CVE-2014-4809 | – | Oct 3 | The WebSEAL component in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, when e-community SSO is enabled, allows remote… Affected: 8.0.0.2; 8.0.0.3; 8.0.0.4 |
| CVE-2014-3053 | – | Jun 21 | The Local Management Interface (LMI) in IBM Security Access Manager (ISAM) for Mobile 8.0 with firmware 8.0.0.0 through 8.0.0.3 and IBM Security Access Manager for Web 7.0, and… Affected: 8.0.0.2; 8.0.0.3 |
| CVE-2014-3052 | – | Jun 21 | The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the… Affected: 8.0.0.2; 8.0.0.3 |
Showing 27