IBM Security Identity Manager
28 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2021-29864 | 6.0.0 ; 6.0.2 | IBM Security Identity Manager 6.0 and 6.0.2 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By per | MEDIUM 6.8 | 0.5 % | ||
| CVE-2021-20488 | 6.0.2 | IBM Security Identity Manager 6.0.2 could allow an authenticated malicious user to change the passwords of other users in the Windows AD env | HIGH 7.5 | 0.9 % | ||
| CVE-2021-20483 | 6.0.2 | IBM Security Identity Manager 6.0.2 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, a remote au | MEDIUM 6.5 | 0.9 % | ||
| CVE-2021-29692 | 7.0.2 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable | MEDIUM 5.9 | 1.0 % | ||
| CVE-2021-29691 | 7.0.2 | IBM Security Identity Manager 7.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo | HIGH 7.5 | 0.9 % | ||
| CVE-2021-29688 | 6.0.2 ; 7.0.2 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is | HIGH 7.5 | 2.0 % | ||
| CVE-2021-29687 | 6.0.2 | IBM Security Identity Manager 7.0.2 could allow a remote user to enumerate usernames due to a difference of responses from valid and invalid | MEDIUM 5.3 | 1.3 % | ||
| CVE-2021-29686 | 7.0.2 | IBM Security Identity Manager 7.0.2 could allow an authenticated user to bypass security and perform actions that they should not have acces | HIGH 8.8 | 0.8 % | ||
| CVE-2021-29683 | 7.0.2 | IBM Security Identity Manager 7.0.2 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: | MEDIUM 6.5 | 0.5 % | ||
| CVE-2021-29682 | 7.0.2 | IBM Security Identity Manager 7.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message is | MEDIUM 5.3 | 1.3 % | ||
| CVE-2019-4675 | 7.0.1 | IBM Security Identity Manager 7.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbo | CRITICAL 9.8 | 1.3 % | ||
| CVE-2019-4674 | 7.0.1 | IBM Security Identity Manager 7.0.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially- | MEDIUM 6.8 | 1.9 % | ||
| CVE-2019-4451 | 6.0.0 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod | MEDIUM 5.4 | 0.6 % | ||
| CVE-2019-4561 | 6.0.0 | IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of | HIGH 8.8 | 3.5 % | ||
| CVE-2018-1968 | 7.0.1 | IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further atta | MEDIUM 5.3 | 1.3 % | ||
| CVE-2019-4038 | 6.0 ; 7.0 | IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potential | HIGH 7.2 | 0.4 % | ||
| CVE-2018-1970 | 7.0.1 | IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacke | HIGH 7.1 | 1.9 % | ||
| CVE-2018-1962 | 7.0.1 | IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of prop | MEDIUM 4.0 | 0.4 % | ||
| CVE-2018-1959 | 7.0.1 | IBM Security Identity Manager 7.0.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it use | HIGH 7.8 | 0.2 % | ||
| CVE-2018-2019 | 6.0.0 | IBM Security Identity Manager 6.0.0 Virtual Appliance is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data | HIGH 7.1 | 2.4 % | ||
| CVE-2018-1969 | 6.0.0 | IBM Security Identity Manager 6.0.0 allows the attacker to upload or transfer files of dangerous types that can be automatically processed w | CRITICAL 9.9 | 1.7 % | ||
| CVE-2018-1967 | 6.0.0 | IBM Security Identity Manager 6.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript cod | MEDIUM 6.1 | 1.3 % | ||
| CVE-2018-1956 | 6.0.0 | IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers | HIGH 7.5 | 2.0 % | ||
| CVE-2018-1453 | 7.0 | IBM Security Identity Manager Virtual Appliance 7.0 allows an authenticated attacker to upload or transfer files of dangerous types that can | HIGH 8.8 | 2.0 % | ||
| CVE-2017-1405 | 7.0 | IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the or | MEDIUM 4.9 | 0.5 % | ||
| CVE-2017-1483 | 6.0 ; 7.0 | IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowin | HIGH 8.6 | 1.5 % | ||
| CVE-2017-1407 | 6.0 ; 7.0 | IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the | HIGH 8.8 | 3.4 % | ||
| CVE-2017-1362 | 6.0 ; 7.0 | IBM Security Identity Manager Adapters 6.0 and 7.0 stores user credentials in plain in clear text which can be read by a local user. IBM X-F | HIGH 7.8 | 0.3 % |