IBM Security Verify Directory Integrator vulnerabilities

5 CVEs affecting IBM Security Verify Directory Integrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-28771, published 2025-01-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-33162, published 2024-08-16. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a…
CVE-2022-33167, published 2024-07-30. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly…
CVE-2024-28766, published 2025-01-27. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could disclose sensitive information about directory contents that could aid in further attacks against the…
CVE-2024-28771, published 2025-01-27. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get…
CVE-2024-28770, published 2025-01-27. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get…