Product:

Sterling_external_authentication_server

(Ibm)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 11
Date Id Summary Products Score Patch Annotated
2023-02-08 CVE-2022-35720 IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information. IBM X-Force ID: 231373. Sterling_external_authentication_server, Sterling_secure_proxy 5.5
2023-09-05 CVE-2023-32338 IBM Sterling Secure Proxy and IBM Sterling External Authentication Server 6.0.3 and 6.1.0 stores user credentials in plain clear text which can be read by a local user with container access. IBM X-Force ID: 255585. Sterling_external_authentication_server, Sterling_secure_proxy 5.5
2023-09-05 CVE-2023-29261 IBM Sterling Secure Proxy 6.0.3 and 6.1.0 could allow a local user with specific information about the system to obtain privileged information due to inadequate memory clearing during operations. IBM X-Force ID: 252139. Sterling_external_authentication_server 5.5
2021-08-30 CVE-2021-29728 IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 201160. Sterling_external_authentication_server, Sterling_secure_proxy 4.9
2021-08-30 CVE-2021-29722 IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 201095. Sterling_external_authentication_server, Sterling_secure_proxy 7.5
2021-08-30 CVE-2021-29723 IBM Sterling Secure Proxy 6.0.1, 6.0.2, 2.4.3.2, and 3.4.3.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-ForceID: 201100. Sterling_external_authentication_server, Sterling_secure_proxy 7.5
2022-02-24 CVE-2022-22349 IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144. Sterling_external_authentication_server 4.3
2022-02-23 CVE-2022-22333 IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 and IBM Sterling External Authentication Server are vulnerable a buffer overflow, due to the Jetty based GUI in the Secure Zone not properly validating the sizes of the form content and/or HTTP headers submitted. A local attacker positioned inside the Secure Zone could submit a specially crafted HTTP request to disrupt service. IBM X-Force ID: 219133. Sterling_external_authentication_server, Sterling_secure_proxy 6.5
2022-02-23 CVE-2022-22336 IBM Sterling External Authentication Server and IBM Sterling Secure Proxy 6.0.3.0, 6.0.2.0, and 3.4.3.2 could allow a remote user to consume resources causing a denial of service due to a resource leak. IBM X-Force ID: 219395. Sterling_external_authentication_server, Sterling_secure_proxy 7.5
2020-07-16 CVE-2020-4462 IBM Sterling External Authentication Server 6.0.1, 6.0.0, 2.4.3.2, and 2.4.2 and IBM Sterling Secure Proxy 6.0.1, 6.0.0, 3.4.3, and 3.4.2 are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 181482. Sterling_external_authentication_server, Sterling_secure_proxy N/A