IBM Security Identity Governance And Intelligence vulnerabilities

39 CVEs affecting IBM Security Identity Governance And Intelligence, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4957, published 2022-05-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1756, published 2018-09-07. High severity, CVSS 7.5. EPSS: 10.6% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to…
CVE-2017-1407, published 2017-09-28. High severity, CVSS 8.8. EPSS: 3.4% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an…
CVE-2020-4795, published 2021-02-09. High severity, CVSS 8.2. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information to an unauthorized user using a specially crafted HTTP request. IBM X-Force ID: 189446.
CVE-2020-4958, published 2021-01-21. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. IBM…
CVE-2017-1395, published 2018-07-13. Medium severity, CVSS 5.9. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence Virtual Appliance 5.2 through 5.2.3.2 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP…
CVE-2018-1757, published 2018-09-07. Medium severity, CVSS 5.3. EPSS: 1.7% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.3.2 and 5.2.4 could allow an attacker to obtain sensitive information due to missing authentication in IGI for the survey application. IBM…
CVE-2017-1483, published 2017-09-28. High severity, CVSS 8.6. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Security Identity Manager Adapters 6.0 and 7.0 does not perform an authentication check for a critical resource or functionality allowing anonymous users access to protected areas. IBM X-Force…
CVE-2017-1411, published 2018-08-06. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Security Identity Governance Virtual Appliance 5.2 through 5.2.3.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…
CVE-2020-4966, published 2021-01-21. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a…
CVE-2020-4246, published 2020-05-28. High severity, CVSS 7.1. EPSS: 1.4% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to…

Latest

CVE-2020-4957, published 2022-05-17. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could disclose sensitive information in URL parameters that could aid in future attacks against the system. IBM X-Force ID: 192208.
CVE-2020-4996, published 2021-02-09. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could allow a local user to obtain sensitive information via the capturing of screenshots of authentication credentials. IBM X-Force ID: 192913.
CVE-2020-4995, published 2021-02-09. Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 does not invalidate session after logout which could allow a user to obtain sensitive information from another users' session. IBM X-Force ID:…
CVE-2020-4791, published 2021-02-09. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could allow an attacker to obtain sensitive information using main in the middle attacks due to improper certificate validation. IBM X-Force…
CVE-2020-4790, published 2021-02-09. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could allow a user to cause a denial of service due to improperly validating a supplied URL, rendering the application unusuable. IBM X-Force…
CVE-2020-4969, published 2021-01-21. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An…
CVE-2020-4968, published 2021-01-21. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427.