Show filters
11 Total Results
Displaying 1-10 of 11
Sort by:
Attacker Value
Unknown
CVE-2009-1082
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 allows remote authenticated users to gain privileges by submitting crafted commands to the Admin Console, as demonstrated by privileges for account creation and other administrative capabilities, related to the saveNoValidate action and saveNoValidateAllowedFormsAndWorkflows IDs.
0
Attacker Value
Unknown
CVE-2009-1079
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19659, 19660, and 19683.
0
Attacker Value
Unknown
CVE-2009-1084
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not properly restrict access to the System Configuration object, which allows remote authenticated administrators and possibly remote attackers to have an unspecified impact by modifying this object.
0
Attacker Value
Unknown
CVE-2009-1083
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 on Linux, AIX, Solaris, and HP-UX permits "control characters" in the passwords of user accounts, which allows remote attackers to execute arbitrary commands via vectors involving "resource adapters."
0
Attacker Value
Unknown
CVE-2009-1078
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the expected privilege requirements for (1) deleting audit policies and (2) modifying workflows, which allows remote authenticated users to have an unspecified impact.
0
Attacker Value
Unknown
CVE-2009-1077
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
The Change My Password implementation in the admin interface in Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not enforce the RequiresChallenge property setting, which allows remote authenticated users to change the passwords of other users, as demonstrated by changing the administrator's password.
0
Attacker Value
Unknown
CVE-2009-1074
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 does not use SSL in all expected circumstances, which makes it easier for remote attackers to obtain sensitive information by sniffing the network, related to "ssl termination devices" and lack of support for relative URLs.
0
Attacker Value
Unknown
CVE-2009-1076
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the end-user question-based login feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
0
Attacker Value
Unknown
CVE-2009-1081
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Identity Manager (IdM) 7.0 through 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs 19595 and 19661.
0
Attacker Value
Unknown
CVE-2009-1075
Disclosure Date: March 25, 2009 (last updated October 04, 2023)
Sun Java System Identity Manager (IdM) 7.0 through 8.0 responds differently to failed use of the Forgot Password feature depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
0