Description

IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703.

Remediation

References

CVE-2018-1804

Related Vulnerabilities

Zope Web Application Server Other Vulnerability (CVE-2001-1227)

Oracle Application Server Observable Differences in Behavior to Error Inputs Vulnerability (CVE-2018-5407)

WordPress Plugin Availability Calendar Cross-Site Scripting (1.2.1)

Magento Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2019-8140)

WebLogic Deserialization of Untrusted Data Vulnerability (CVE-2020-11112)

Severity

Low

Classification

CVE-2018-1804 CWE-384 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities