IBM Security Identity Manager Virtual Appliance vulnerabilities

12 CVEs affecting IBM Security Identity Manager Virtual Appliance, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-4706, published 2020-07-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-0324, published 2018-01-12. High severity, CVSS 8.8. EPSS: 3.7% chance of exploitation in the next 30 days. IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges…
CVE-2016-0332, published 2018-01-12. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 do not properly restrict failed login attempts, which makes it easier for remote attackers…
CVE-2018-1968, published 2019-07-11. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM Security Identity Manager 7.0.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153749.
CVE-2016-0351, published 2018-02-21. Low severity, CVSS 3.7. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 does not set the secure flag for the session cookie in an HTTPS session, which makes it easier for remote attackers…
CVE-2016-9704, published 2017-02-01. Medium severity, CVSS 6.1. EPSS: 1% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended…
CVE-2016-0367, published 2018-02-21. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.x before 7.0.1.3-ISS-SIM-IF0001 allows remote authenticated users to obtain sensitive information by reading an error message. IBM X-Force ID:…
CVE-2019-4706, published 2020-07-01. Low severity, CVSS 2.7. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.2 writes information to log files which can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user…
CVE-2019-4705, published 2020-07-01. Low severity, CVSS 2.7. EPSS: 0.8% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.2 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 172015.
CVE-2019-4704, published 2020-07-01. Medium severity, CVSS 4.3. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http://…
CVE-2019-4676, published 2020-07-01. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Security Identity Manager Virtual Appliance 7.0.2 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 171512.

Latest

CVE-2016-0327, published 2018-01-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows local users to gain administrator privileges via unspecified vectors. IBM X-Force ID:…