Vulnerabilities > IBM > Security Access Manager FOR WEB 8 0 Firmware

DATE CVE VULNERABILITY TITLE RISK
2017-02-01 CVE-2016-3022 Permission Issues vulnerability in IBM products
IBM Security Access Manager for Web could allow an authenticated user to gain access to highly sensitive information due to incorrect file permissions.
network
low complexity
ibm CWE-275
6.5
2017-02-01 CVE-2016-3021 Information Exposure vulnerability in IBM products
IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.
network
low complexity
ibm CWE-200
2.7
2017-02-01 CVE-2016-3017 Improperly Implemented Security Check for Standard vulnerability in IBM products
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information due to security misconfigurations.
network
low complexity
ibm CWE-358
7.5
2017-02-01 CVE-2016-3016 Insufficient Verification of Data Authenticity vulnerability in IBM products
IBM Security Access Manager for Web processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code, which could allow an authenticated attacker to load malicious code.
network
high complexity
ibm CWE-345
4.4
2017-02-01 CVE-2016-2908 XXE vulnerability in IBM products
IBM Single Sign On for Bluemix could allow a remote attacker to obtain sensitive information, caused by a XML external entity (XXE) error when processing XML data by the XML parser.
network
low complexity
ibm CWE-611
critical
9.1
2016-02-15 CVE-2015-8531 Cross-site Scripting vulnerability in IBM products
Cross-site scripting (XSS) vulnerability in IBM Security Access Manager for Web 8.0 before 8.0.1.3 IF4 and 9.0 before 9.0.0.1 IF1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
network
low complexity
ibm CWE-79
6.1
2016-02-15 CVE-2015-5012 Cryptographic Issues vulnerability in IBM products
The SSH implementation on IBM Security Access Manager for Web appliances 7.0 before 7.0.0 FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 does not properly restrict the set of MAC algorithms, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
network
low complexity
ibm CWE-310
7.5
2016-02-15 CVE-2015-5010 7PK - Security Features vulnerability in IBM products
IBM Security Access Manager for Web 7.0 before 7.0.0 IF21, 8.0 before 8.0.1.3 IF4, and 9.0 before 9.0.0.1 IF1 does not have a lockout mechanism for invalid login attempts, which makes it easier for remote attackers to obtain access via a brute-force attack.
network
low complexity
ibm CWE-254
7.5
2016-01-02 CVE-2015-5018 OS Command Injection vulnerability in IBM products
IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.
network
high complexity
ibm CWE-78
8.0
2014-09-25 CVE-2014-7169 OS Command Injection vulnerability in multiple products
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.
9.8