IBM Data Risk Manager Directory Traversal Vulnerability

概要

参考情報

• exchange.xforce.ibmcloud.com/vulnerabilities/180535 · VDB Entry
• ibm.com/support/pages/node/6206875 · Patch
• seclists.org/fulldisclosure/2024/Nov/0 · Mailing List
• seclists.org/fulldisclosure/2024/Nov/1 · Mailing List
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2020-4430

data risk manager のその他の脆弱性

• CVE-2021-38915中 6.5IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 209947.
• CVE-2021-38862高 7.5IBM Data Risk Manager (iDNA) 2.0.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensiti…
• CVE-2020-4622高 7.5IBM Data Risk Manager (iDNA) 2.0.6 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbou…
• CVE-2020-4621高 8.8IBM Data Risk Manager (iDNA) 2.0.6 could allow an authenticated user to escalate their privileges to administrator due to insufficient autho…
• CVE-2020-4620高 8.8IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation …