Vulnerabilities > IBM > Medium

DATE CVE VULNERABILITY TITLE RISK
2014-12-18 CVE-2014-6089 Data Processing Errors vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (disrupted system operations) by uploading a file to a protected area.
network
low complexity
ibm CWE-19
4.0
2014-12-18 CVE-2014-6088 Information Exposure vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by sniffing the network during use of the null SSL cipher.
network
low complexity
ibm CWE-200
5.0
2014-12-18 CVE-2014-6087 Cryptographic Issues vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak algorithm in an SSL cipher suite.
network
low complexity
ibm CWE-310
5.0
2014-12-18 CVE-2014-6086 Information Exposure vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session.
network
low complexity
ibm CWE-200
5.0
2014-12-18 CVE-2014-6084 Cryptographic Issues vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak SSL cipher.
network
low complexity
ibm CWE-310
5.0
2014-12-18 CVE-2014-6083 Information Exposure vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.
network
low complexity
ibm CWE-200
5.0
2014-12-18 CVE-2014-6082 Denial-Of-Service vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (administration UI outage) via unspecified vectors.
network
low complexity
ibm
4.0
2014-12-18 CVE-2014-6080 SQL Injection vulnerability in IBM products
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
network
low complexity
ibm CWE-89
6.5
2014-12-18 CVE-2014-6078 Improper Access Control vulnerability in IBM products
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.
network
low complexity
ibm CWE-284
5.0
2014-12-18 CVE-2014-6077 Cross-Site Request Forgery (CSRF) vulnerability in IBM products
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.
network
ibm CWE-352
6.8