IBM Verify Identity Access vulnerabilities

IBM Verify Identity Access is vulnerable to a buffer overflow attack.

IBM Verify Identity Access containers may not apply management password change operations correctly.

IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain elevated privileges due to the use of hard-coded credentials.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests.

IBM Verify Identity Access contains a vulnerability due to improper validation of user-supplied input. An administrator could execute additional commands they are not entitled to.

IBM Verify Identity Access contains a vulnerability due to insufficient validation of incoming request resources. A remote attacker could cause a denial of service.

IBM Verify Identity Access allows a remote attacker to conduct phishing attacks via an open redirect. By luring a victim to a crafted website, the attacker can spoof the displayed URL and redirect the user to a malicious site that appears trusted.

This entry covers IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001, IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001, and the corresponding container versions. The description does not include technical details of the vulnerability.

IBM Verify Identity Access is missing origin validation, allowing a remote attacker to perform operations as the victim and potentially launch further attacks against the systems.

IBM Verify Identity Access allows a remote attacker to cause a denial of service due to insufficient validation of incoming request resources. The flaw affects how the product processes requests.

IBM Verify Identity Access Advanced Access Control may be vulnerable to an information disclosure attack.

IBM Verify Identity Access and Security Verify Access products may return detailed technical error messages in the browser, allowing a remote attacker to obtain sensitive information.

IBM Verify Identity Access and IBM Security Verify Access contain an open redirect vulnerability that allows a remote attacker to conduct phishing attacks by using a specially crafted request to redirect a victim to arbitrary websites.

IBM Verify Identity Access and IBM Security Verify Access in the specified versions could allow an attacker with read-only privileges to make unauthorized modifications and deployments outside of their assigned permissions.

IBM Verify Identity Access and IBM Security Verify Access (both container and standard editions) use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.

IBM Verify Identity Access Container and IBM Security Verify Access Container versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 return certificate listings as a JSON payload but incorrectly set the Content-Type header to text/html. Browsers may interpret the JSON data as executable script, enabling JavaScript injection and potential cross-site scripting (XSS).

IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1 contain an open redirect vulnerability that could allow a remote attacker to conduct phishing attacks by redirecting a victim to arbitrary websites via a crafted request.