SI
Product
Security Identity Manager
44
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 2High 16Medium 17Low 1
Watch
Add Security Identity Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1969 | 9.9 | Jan 14 | IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment Affected: 6.0.0 |
| CVE-2019-4675 | 9.8 | Feb 4 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… Affected: 7.0.1 |
| CVE-2021-29686 | 8.8 | May 20 | IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have access to Affected: 7.0.2 |
| CVE-2019-4561 | 8.8 | Nov 20 | IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data Affected: 6.0.0 |
| CVE-2018-1453 | 8.8 | Jun 8 | IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the… Affected: 7.0; 7.0.1 |
| CVE-2016-0335 | 8.8 | Jan 12 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.1.0 |
| CVE-2017-1407 | 8.8 | Sep 28 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system Affected: 6.0.0.0; 7.0.0.0 |
| CVE-2014-6106 | 8.8 | Sep 18 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1, 6.0, and 7.0 allows remote attackers to hijack the authentication of users for requests that… Affected: 5.1.0; 5.1.0.3; 5.1.0.4; 5.1.0.5; 5.1.0.6; 5.1.0.7; +14 more |
| CVE-2017-1483 | 8.6 | Sep 28 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected… Affected: 6.0.0.0; 7.0.0.0 |
| CVE-2018-1959 | 7.8 | Jan 24 | IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication,… Affected: 7.0.1 |
| CVE-2014-6111 | 7.8 | Apr 20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 store… Affected: 6.0; 7.0 |
| CVE-2017-1362 | 7.8 | Sep 25 | IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user Affected: 6.0; 7.0 |
| CVE-2016-9739 | 7.8 | Feb 1 | IBM Security Identity Manager Virtual Appliance stores user credentials in plain in clear text which can be read by a local user Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.1.0; 7.0.1.1; +3 more |
| CVE-2021-29691 | 7.5 | May 20 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound… Affected: 7.0.2 |
| CVE-2021-29688 | 7.5 | May 20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 6.0.2; 7.0.2 |
| CVE-2018-1956 | 7.5 | Jan 14 | IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts Affected: 6.0.0 |
| CVE-2018-1970 | 7.1 | Feb 4 | IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 7.0.1 |
| CVE-2018-2019 | 7.1 | Jan 18 | IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data Affected: 6.0.0 |
| CVE-2021-20488 | 6.5 | Jun 16 | IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD environment when IBM Security Identity… Affected: 6.0.2 |
| CVE-2021-20483 | 6.5 | Jun 16 | IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF) Affected: 6.0.2 |
| CVE-2021-29683 | 6.5 | May 20 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user Affected: 7.0.2 |
| CVE-2019-4038 | 6.2 | Feb 4 | IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks Affected: 6.0; 7.0 |
| CVE-2021-29864 | 6.1 | Aug 30 | IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack Affected: 6.0.0; 6.0.2 |
| CVE-2018-1967 | 6.1 | Jan 14 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting Affected: 6.0.0 |
| CVE-2020-4970 | 5.9 | May 19 | IBM Security Identity Governance and Intelligence 5.2.4, 5.2.5, and 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable… Affected: 5.2.4; 5.2.5; 5.2.6 |
| CVE-2021-29692 | 5.9 | May 20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security Affected: 7.0.2 |
| CVE-2014-6112 | 5.9 | Apr 20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 make it… Affected: 6.0; 7.0 |
| CVE-2014-6108 | 5.9 | Apr 20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 might… Affected: 6.0; 7.0 |
| CVE-2019-4451 | 5.4 | Feb 4 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting Affected: 6.0.0 before 6.0.0.22 |
| CVE-2016-0336 | 5.4 | Jan 12 | Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated… Affected: 7.0.0.0; 7.0.0.1; 7.0.0.2; 7.0.0.3; 7.0.1.0 |
| CVE-2021-29687 | 5.3 | May 20 | IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid login attempts Affected: 6.0.2 |
| CVE-2021-29682 | 5.3 | May 20 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser Affected: 7.0.2 |
| CVE-2014-6109 | 5.3 | Apr 20 | IBM Tivoli Identity Manager 5.1.x before 5.1.0.15-ISS-TIM-IF0057 and Security Identity Manager 6.0.x before 6.0.0.4-ISS-SIM-IF0001 and 7.0.x before 7.0.0.0-ISS-SIM-IF0003 allow… Affected: 6.0; 7.0 |
| CVE-2019-4674 | 4.9 | Feb 4 | IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system Affected: 7.0.1 |
| CVE-2017-1405 | 4.9 | Jun 8 | IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code Affected: 7.0; 7.0.1 |
| CVE-2018-1962 | 3.3 | Feb 4 | IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed Affected: 7.0.1 |
| CVE-2014-6168 | – | Dec 29 | Cross-site request forgery (CSRF) vulnerability in IBM Security Identity Manager 5.1 before 5.1.0.15 IF0056 allows remote authenticated users to hijack the authentication of… Affected: 5.1.0; 5.1.0.3; 5.1.0.4; 5.1.0.5; 5.1.0.6; 5.1.0.7; +8 more |
| CVE-2014-6110 | – | Nov 18 | IBM Security Identity Manager 6.x before 6.0.0.3 IF14 does not properly perform logout actions, which allows remote attackers to access sessions by leveraging an unattended… Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-6107 | – | Nov 18 | IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-6105 | – | Nov 18 | IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to conduct clickjacking attacks via unspecified vectors Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-6098 | – | Nov 18 | IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to discover cleartext passwords via a crafted request Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-6096 | – | Nov 18 | Cross-site scripting (XSS) vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to inject arbitrary web script or HTML via a crafted URL Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-6095 | – | Nov 18 | Directory traversal vulnerability in IBM Security Identity Manager 6.x before 6.0.0.3 IF14 allows remote attackers to read arbitrary files via unspecified vectors Affected: 6.0.0.0; 6.0.0.1; 6.0.0.2; 6.0.0.3 |
| CVE-2014-0961 | – | Jun 8 | Cross-site request forgery (CSRF) vulnerability in IBM Tivoli Identity Manager (ITIM) 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager (ISIM) 6.0… Affected: 6.0.0; 6.0.0.1 |
Showing 44