Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Security_directory_server
(Ibm)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 22 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2024-07-25 | CVE-2022-32759 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 uses insufficient session expiration which could allow an unauthorized user to obtain sensitive information. IBM X-Force ID: 228565. | Security_directory_integrator, Security_directory_server, Security_verify_access | 7.5 | ||
| 2024-07-25 | CVE-2024-28772 | IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 285645. | Security_directory_integrator, Security_directory_server, Security_verify_access | 5.4 | ||
| 2023-10-14 | CVE-2022-32755 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228505. | Security_directory_server, Security_directory_suite, Security_verify_directory | 9.1 | ||
| 2023-10-14 | CVE-2022-33161 | IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. X-Force ID: 228569. | Security_directory_integrator, Security_directory_server, Security_directory_suite, Security_verify_directory | 5.9 | ||
| 2023-09-08 | CVE-2022-33164 | IBM Security Directory Server 7.2.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view or write to arbitrary files on the system. IBM X-Force ID: 228579. | Security_directory_server | 9.1 | ||
| 2019-10-02 | CVE-2019-4520 | IBM Security Directory Server 6.4.0 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 165178. | Security_directory_server | 7.5 | ||
| 2019-10-02 | CVE-2019-4539 | IBM Security Directory Server 6.4.0 does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. IBM X-Force ID: 165812. | Security_directory_server | 7.1 | ||
| 2019-10-02 | CVE-2019-4538 | IBM Security Directory Server 6.4.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. IBM X-Force ID: 165660. | Security_directory_server | 8.2 | ||
| 2019-10-02 | CVE-2019-4542 | IBM Security Directory Server 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 165815. | Security_directory_server | 6.1 | ||
| 2019-10-02 | CVE-2019-4549 | IBM Security Directory Server 6.4.0 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 165951. | Security_directory_server | 5.3 |