Brennan Brazeau

The issue makes it easier for remote attackers to obtain sensitive information by leveraging support for weak SSL ciphers.

The issue allows remote attackers to bypass intended security restrictions, execute unspecified commands, and obtain sensitive information via unknown vectors.

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Manager versions 5.1 through 7.0 Description: A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests, potentially leading to cross-site scripting attacks, web cache poisoning, or other impacts. Recommendations: For IBM Security Identity Manager versions 5.1 through 7.0, update to a version that includes a fix for this issue, as no specific workaround is provided in the available data.

The issue allows remote authenticated users to write to arbitrary files. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow a remote attacker to record arbitrary files.

The issue allows remote authenticated users to execute arbitrary commands via unspecified vectors on XGS devices.

A directory traversal issue allows remote attackers to read arbitrary files.

A cross-site scripting (XSS) issue exists in the Admin UI, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted URL.

The issue allows remote attackers to execute arbitrary code. No further details are provided about the vectors used for the attack or the estimated number of potentially affected devices.