Paul Ionescu

The issue makes it easier for remote attackers to obtain sensitive information by leveraging support for weak SSL ciphers.

The issue allows remote attackers to bypass intended security restrictions, execute unspecified commands, and obtain sensitive information via unknown vectors.

The issue allows local users to have an unspecified impact by leveraging administrator access to a hardcoded password, related to use on GRUB systems.

The issue allows local users to obtain sensitive information by reading cached browser data.

The issue makes it easier for remote attackers to capture session cookies by intercepting their transmission within an HTTP session, as the secure flag for the session cookie in an HTTPS session is not set.

Name of the Vulnerable Software and Affected Versions: IBM Security Identity Manager versions 5.1 through 7.0 Description: A cross-site request forgery (CSRF) issue allows remote attackers to hijack user authentication for requests, potentially leading to cross-site scripting attacks, web cache poisoning, or other impacts. Recommendations: For IBM Security Identity Manager versions 5.1 through 7.0, update to a version that includes a fix for this issue, as no specific workaround is provided in the available data.

The issue allows an attacker to obtain sensitive information using man-in-the-middle techniques because sensitive data is transmitted in cleartext in the query of the request.

The issue allows an authenticated user to access some privileged functionality of the server.

The issue allows an authenticated user to read user credentials stored in plain text.

The issue allows anonymous users to access protected areas due to a lack of authentication check for a critical resource or functionality.

The issue allows an attacker to execute malicious and unauthorized actions by exploiting cross-site request forgery. This could be done by transmitting actions from a user that the website trusts.

The issue concerns Cross-Origin Resource Sharing (CORS), a mechanism that enables web sites to request resources from external sites. This allows for the sharing of resources without the need for duplication.

A remote authenticated attacker could execute arbitrary commands on the system by sending a specially-crafted request, allowing for the exploitation of this issue to execute arbitrary commands on the system.

The issue allows a remote attacker to send specially-crafted SQL statements, potentially enabling them to view information in the back-end database. This is due to a SQL injection flaw.

A remote authenticated attacker could execute arbitrary commands on the system by sending a specially-crafted request, allowing for the exploitation of the system.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session.

The issue is caused by an XML External Entity Injection (XXE) error when processing XML data, which could allow a remote attacker to expose highly sensitive information or consume all available memory resources, resulting in a denial of service.

The issue discloses sensitive information to unauthorized users, which can be used to mount further attacks on the system.

The issue allows a remote attacker to consume all resources on the server due to improper restriction of the size or amount of resources requested by an actor.