IBM Security Access Manager vulnerabilities

48 CVEs affecting IBM Security Access Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-35139, published 2024-06-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1722, published 2018-08-24. Critical severity, CVSS 10.0. EPSS: 9% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation services are running. IBM X-Force ID: 147370.
CVE-2016-3028, published 2016-11-25. Critical severity, CVSS 9.1. EPSS: 3.5% chance of exploitation in the next 30 days. IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by…
CVE-2018-1850, published 2018-10-22. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 9.0.3.1, 9.0.4.0 and 9.0.5.0 could allow unauthorized administration operations when Advanced Access Control services are running. IBM X-Force ID: 150998.
CVE-2017-1476, published 2018-06-06. Medium severity, CVSS 5.9. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable…
CVE-2018-1970, published 2019-02-04. High severity, CVSS 7.1. EPSS: 1.9% chance of exploitation in the next 30 days. IBM Security Identity Manager 7.0.1 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive…
CVE-2017-1480, published 2018-06-06. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read by a remote user. IBM X-Force ID:…
CVE-2017-1474, published 2018-06-06. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The information can be used to mount further…
CVE-2016-3025, published 2016-11-25. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed login attempts, which makes it easier for remote…
CVE-2019-4135, published 2019-06-25. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Security Access Manager 9.0.1 through 9.0.6 is affected by a security vulnerability that could allow authenticated users to impersonate other users. IBM X-Force ID: 158331.
CVE-2019-4707, published 2020-01-28. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 9.0.7.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose…

Latest

CVE-2024-35139, published 2024-06-28. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain sensitive information from the container due to incorrect default permissions. IBM X-Force ID: 292415.
CVE-2024-35137, published 2024-06-28. Medium severity, CVSS 6.2. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to possibly elevate their privileges due to sensitive configuration information being exposed. IBM X-Force ID: …
CVE-2023-38370, published 2024-06-27. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1, under certain configurations, could allow a user on the network to install malicious packages. IBM X-Force ID: 261197.
CVE-2023-38368, published 2024-06-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could disclose sensitive information to a local user to do improper permission controls. IBM X-Force ID: 261195.
CVE-2023-30998, published 2024-06-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254649.
CVE-2023-30997, published 2024-06-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 could allow a local user to obtain root access due to improper access controls. IBM X-Force ID: 254638.
CVE-2023-38371, published 2024-06-27. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Security Access Manager Docker 10.0.0.0 through 10.0.7.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: …
CVE-2021-20439, published 2021-07-15. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Security Access Manager 9.0 and IBM Security Verify Access Docker 10.0.0 stores user credentials in plain clear text which can be read by an unauthorized user.
CVE-2020-4499, published 2020-10-15. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 could allow an unauthorized public Oauth client to bypass some or all of the authentication checks and gain access to…
CVE-2019-4552, published 2020-10-15. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security Access Manager 9.0.7 and IBM Security Verify Access 10.0.0 are vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted…