SI
Product
Security Identity Governance and Intelligence
39
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 11Medium 24Low 2
Watch
Add Security Identity Governance and Intelligence to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-4958 | 9.8 | Jan 21 | IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant… Affected: 5.2.6 |
| CVE-2018-1944 | 9.8 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2017-1407 | 8.8 | Sep 28 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system Affected: 5.2.0; 5.2.1 |
| CVE-2017-1483 | 8.6 | Sep 28 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected… Affected: 5.2; 5.2.1 |
| CVE-2020-4795 | 8.2 | Feb 9 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request Affected: 5.2.6 |
| CVE-2017-1396 | 8.1 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 specifies permissions for a security-critical resource in a way that allows that resource to be read or… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2020-4245 | 7.5 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user… Affected: 5.2.6 |
| CVE-2020-4232 | 7.5 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to enumerate usernames to find valid login credentials which could be used to attempt further… Affected: 5.2.6 |
| CVE-2018-1946 | 7.5 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2018-1756 | 7.5 | Sep 7 | IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection Affected: 5.2.3.2; 5.2.4 |
| CVE-2017-1366 | 7.5 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2017-1411 | 7.5 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2020-4246 | 7.1 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data Affected: 5.2.6 |
| CVE-2017-1755 | 6.7 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 could allow a local attacker to inject commands into malicious files that could be executed by the… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2020-4790 | 6.5 | Feb 9 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering the application… Affected: 5.2.6 |
| CVE-2020-4968 | 6.5 | Jan 21 | IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information Affected: 5.2.6 |
| CVE-2020-4249 | 6.5 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose highly sensitive information to other authenticated users on the sytem due to incorrect authorization Affected: 5.2.6 |
| CVE-2020-4231 | 6.5 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an authenticated user to perform unauthorized commands due to hazardous input validation Affected: 5.2.6 |
| CVE-2017-1368 | 6.5 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not set the secure attribute on authorization tokens or session cookies Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2018-1947 | 6.1 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2018-1945 | 6.1 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2020-4969 | 5.9 | Jan 21 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict… Affected: 5.2.6 |
| CVE-2017-1395 | 5.9 | Jul 13 | IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to… Affected: 5.2 through 5.2.3.2 |
| CVE-2020-4996 | 5.5 | Feb 9 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentication credentials Affected: 5.2.6 |
| CVE-2020-4957 | 5.3 | May 17 | IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the system Affected: 5.2.6 |
| CVE-2020-4995 | 5.3 | Feb 9 | IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users'… Affected: 5.2.6 |
| CVE-2020-4791 | 5.3 | Feb 9 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to improper certificate… Affected: 5.2.6 |
| CVE-2020-4244 | 5.3 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow an unauthorized user to obtain sensitive information through user enumeration Affected: 5.2.6 |
| CVE-2020-4233 | 5.3 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to set the secure flag for the session… Affected: 5.2.6 |
| CVE-2018-1757 | 5.3 | Sep 7 | IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey… Affected: 5.2.3.2; 5.2.4 |
| CVE-2017-1409 | 5.3 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 discloses sensitive information to unauthorized users Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2017-1367 | 5.3 | Jul 13 | IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 stores sensitive information in URL parameters Affected: 5.2.0 through 5.2.3.2 |
| CVE-2020-4966 | 4.3 | Jan 21 | IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies Affected: 5.2.6 |
| CVE-2018-1950 | 4.3 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment,… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2018-1949 | 4.3 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2018-1948 | 4.3 | Feb 21 | IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +3 more |
| CVE-2017-1412 | 4.3 | Aug 6 | IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 generates an error message that includes sensitive information about its environment, users, or associated… Affected: 5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; +1 more |
| CVE-2020-4243 | 3.7 | Aug 5 | IBM Security Identity Governance and Intelligence 5.2.6 Virtual Appliance could allow a remote attacker to obtain sensitive information using man in the middle techniques due to… Affected: 5.2.6 |
| CVE-2020-4248 | 2.7 | May 28 | IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the… Affected: 5.2.6 |
Showing 39