IBM Security Directory Integrator vulnerabilities

11 CVEs affecting IBM Security Directory Integrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-28765, published 2026-05-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-33165, published 2023-10-14. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../)…
CVE-2024-28767, published 2024-12-20. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 through 7.2.0.13 and 10.0.0 through 10.0.3 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially…
CVE-2022-33161, published 2023-10-14. Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit…
CVE-2022-33162, published 2024-08-16. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a…
CVE-2022-33167, published 2024-07-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly…
CVE-2024-28765, published 2026-05-27. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message…
CVE-2022-32759, published 2024-07-25. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthorized user to obtain sensitive…
CVE-2024-28766, published 2025-01-27. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the…
CVE-2024-28772, published 2024-07-25. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript…
CVE-2024-28771, published 2025-01-27. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get…

Latest

CVE-2024-28770, published 2025-01-27. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get…