IBM Security Access Manager For Web vulnerabilities

20 CVEs affecting IBM Security Access Manager For Web, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1480, published 2018-06-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3028, published 2016-11-25. Critical severity, CVSS 9.1. EPSS: 3.5% chance of exploitation in the next 30 days. IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by…
CVE-2015-4963, published 2015-11-08. High severity, CVSS 7.5. EPSS: 3.3% chance of exploitation in the next 30 days. IBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote attackers to read or write to arbitrary files via…
CVE-2013-6329, published 2013-12-17. High severity, CVSS 7.8. EPSS: 3.2% chance of exploitation in the next 30 days. IBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of service via a crafted handshake during resumption…
CVE-2017-1476, published 2018-06-06. Medium severity, CVSS 5.9. EPSS: 2.2% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable…
CVE-2017-1480, published 2018-06-06. Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 stores potentially sensitive information in log files that could be read by a remote user. IBM X-Force ID:…
CVE-2017-1474, published 2018-06-06. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The information can be used to mount further…
CVE-2014-6082, published 2014-12-18. Medium severity, CVSS 4.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service…
CVE-2014-6078, published 2014-12-18. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which…
CVE-2014-6088, published 2014-12-18. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by…
CVE-2014-6087, published 2014-12-18. Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive…

Latest

CVE-2017-1489, published 2017-08-29. Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Security Access Manager 6.1, 7.0, 8.0, and 9.0 e-community configurations may be affected by a redirect vulnerability. ECSSO Master Authentication can redirect to a server not participating in an…
CVE-2016-3045, published 2017-02-01. Low severity, CVSS 3.7. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer…
CVE-2016-3018, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Access Manager for Web is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality…
CVE-2014-6089, published 2014-12-18. Medium severity, CVSS 4.0. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service…