IBM Verify Gateway vulnerabilities

8 CVEs affecting IBM Verify Gateway, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-4405, published 2020-07-27.

More from IBM.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2020-4400, published 2020-07-22. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 179478.
• CVE-2020-4385, published 2020-07-22. Critical severity, CVSS 9.8. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external…
• CVE-2020-4399, published 2020-07-22. Medium severity, CVSS 6.5. EPSS: 1.1% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could allow an authenticated user to send malformed requests to cause a denial of service against the server. IBM X-Force ID: 179476.
• CVE-2020-4405, published 2020-07-27. Medium severity, CVSS 4.3. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 could disclose potentially sensitive information to an authenticated user due to world readable log files. IBM X-Force ID: 179484.
• CVE-2020-4397, published 2020-07-22. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 transmits sensitive information in plain text which could be obtained by an attacker using man in the middle techniques. IBM X-Force ID: 179428.
• CVE-2020-4371, published 2020-07-22. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 contains sensitive information in leftover debug code that could be used aid a local user in further attacks against the system. IBM X-Force ID: 179008.
• CVE-2020-4372, published 2020-07-22. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores user credentials in plain in clear text which can be read by a local user. IBM X-Force ID: 179009
• CVE-2020-4369, published 2020-07-22. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Verify Gateway (IVG) 1.0.0 and 1.0.1 stores highly sensitive information in cleartext that could be obtained by a user. IBM X-Force ID: 179004.