var-201702-0371
Vulnerability from variot
IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Security Access Manager is prone to an information-disclosure vulnerability. Successful exploits will lead to other attacks. There are information disclosure vulnerabilities in many ISAM products
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201702-0371", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "security access manager 9.0", "scope": "eq", "trust": 1.0, "vendor": "ibm", "version": "*" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 1.0, "vendor": "ibm", "version": "*" }, { "model": "security access manager for web 8.0", "scope": "eq", "trust": 1.0, "vendor": "ibm", "version": "*" }, { "model": "security access manager for web 7.0", "scope": "eq", "trust": 1.0, "vendor": "ibm", "version": "*" }, { "model": "security access manager for mobile the appliance", "scope": null, "trust": 0.8, "vendor": "ibm", "version": null }, { "model": "security access manager for mobile software", "scope": "eq", "trust": 0.8, "vendor": "ibm", "version": "8.0" }, { "model": "security access manager for web the appliance", "scope": null, "trust": 0.8, "vendor": "ibm", "version": null }, { "model": "security access manager for web software", "scope": "eq", "trust": 0.8, "vendor": "ibm", "version": "7.0" }, { "model": "security access manager for web software", "scope": "eq", "trust": 0.8, "vendor": "ibm", "version": "8.0" }, { "model": "security access manager the appliance", "scope": null, "trust": 0.8, "vendor": "ibm", "version": null }, { "model": "security access manager software", "scope": "eq", "trust": 0.8, "vendor": "ibm", "version": "9.0" }, { "model": "security access manager for mobile", "scope": null, "trust": 0.6, "vendor": "ibm", "version": null }, { "model": "security access manager for web 7.0", "scope": null, "trust": 0.6, "vendor": "ibm", "version": null }, { "model": "security access manager for web 8.0", "scope": null, "trust": 0.6, "vendor": "ibm", "version": null }, { "model": "security access manager 9.0", "scope": null, "trust": 0.6, "vendor": "ibm", "version": null }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.03" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.02" }, { "model": "security access manager for web fp19", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.4" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.3" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.2" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.1" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.0" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.5" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.4" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.0" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.9" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.8" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.7" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.6" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.5" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.4" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.3" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.20" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.2" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.19" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.18" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.17" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.16" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.15" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.14" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.13" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.12" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.11" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.10" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0.0.1" }, { "model": "security access manager for web", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "7.0" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.4" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.3" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.2" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.1" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.5" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.4" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.3" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.2" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.1" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0.0.0" }, { "model": "security access manager for mobile", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "8.0" }, { "model": "security access manager", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "9.0.1.0" }, { "model": "security access manager", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "9.0.0.1" }, { "model": "security access manager", "scope": "eq", "trust": 0.3, "vendor": "ibm", "version": "9.0" }, { "model": "security access manager for web", "scope": "ne", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.5" }, { "model": "security access manager for mobile", "scope": "ne", "trust": 0.3, "vendor": "ibm", "version": "8.0.1.5" }, { "model": "security access manager", "scope": "ne", "trust": 0.3, "vendor": "ibm", "version": "9.0.2.0" } ], "sources": [ { "db": "BID", "id": "95107" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/h:ibm:security_access_manager_for_mobile_appliance", "vulnerable": true }, { "cpe22Uri": "cpe:/o:ibm:security_access_manager_for_mobile_software", "vulnerable": true }, { "cpe22Uri": "cpe:/h:ibm:security_access_manager_for_web_appliance", "vulnerable": true }, { "cpe22Uri": "cpe:/o:ibm:security_access_manager_for_web_software", "vulnerable": true }, { "cpe22Uri": "cpe:/h:ibm:security_access_manager_appliance", "vulnerable": true }, { "cpe22Uri": "cpe:/o:ibm:security_access_manager_9.0_firmware", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007350" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Dmitryi Beryoza, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd,Paul Ionescu", "sources": [ { "db": "CNNVD", "id": "CNNVD-201612-743" } ], "trust": 0.6 }, "cve": "CVE-2016-3043", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CVE-2016-3043", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "VHN-91862", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "HIGH", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "exploitabilityScore": 2.2, "id": "CVE-2016-3043", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.8, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2016-3043", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2016-3043", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-201612-743", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-91862", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-91862" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques. IBM Security Access Manager is prone to an information-disclosure vulnerability. Successful exploits will lead to other attacks. There are information disclosure vulnerabilities in many ISAM products", "sources": [ { "db": "NVD", "id": "CVE-2016-3043" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "BID", "id": "95107" }, { "db": "VULHUB", "id": "VHN-91862" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2016-3043", "trust": 2.8 }, { "db": "BID", "id": "95107", "trust": 2.0 }, { "db": "JVNDB", "id": "JVNDB-2016-007350", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201612-743", "trust": 0.7 }, { "db": "VULHUB", "id": "VHN-91862", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-91862" }, { "db": "BID", "id": "95107" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "id": "VAR-201702-0371", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-91862" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T22:07:39.159000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "1995446", "trust": 0.8, "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995446" }, { "title": "Multiple IBM Security Access Manager Product information disclosure vulnerability repair measures", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=66702" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-200", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-91862" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://www.securityfocus.com/bid/95107" }, { "trust": 1.7, "url": "http://www.ibm.com/support/docview.wss?uid=swg21995446" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-3043" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-3043" }, { "trust": 0.3, "url": "http://www.ibm.com/" }, { "trust": 0.3, "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21995446" } ], "sources": [ { "db": "VULHUB", "id": "VHN-91862" }, { "db": "BID", "id": "95107" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-91862" }, { "db": "BID", "id": "95107" }, { "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "db": "CNNVD", "id": "CNNVD-201612-743" }, { "db": "NVD", "id": "CVE-2016-3043" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-02-01T00:00:00", "db": "VULHUB", "id": "VHN-91862" }, { "date": "2016-12-08T00:00:00", "db": "BID", "id": "95107" }, { "date": "2017-02-27T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "date": "2016-12-28T00:00:00", "db": "CNNVD", "id": "CNNVD-201612-743" }, { "date": "2017-02-01T20:59:00.770000", "db": "NVD", "id": "CVE-2016-3043" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2020-10-27T00:00:00", "db": "VULHUB", "id": "VHN-91862" }, { "date": "2017-01-12T08:06:00", "db": "BID", "id": "95107" }, { "date": "2017-02-27T00:00:00", "db": "JVNDB", "id": "JVNDB-2016-007350" }, { "date": "2020-10-28T00:00:00", "db": "CNNVD", "id": "CNNVD-201612-743" }, { "date": "2024-11-21T02:49:15.027000", "db": "NVD", "id": "CVE-2016-3043" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201612-743" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "IBM Security Access Manager Vulnerability in which important information is obtained", "sources": [ { "db": "JVNDB", "id": "JVNDB-2016-007350" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "information disclosure", "sources": [ { "db": "CNNVD", "id": "CNNVD-201612-743" } ], "trust": 0.6 } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.