CVE-2017-1474

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

IBM Security Access Manager Appliance 7.0.0, 8.0.0 through 8.0.1.6, and 9.0.0 through 9.0.3.1 discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 128606.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
IBM	Security Access Manager	9.0.0.1; 7.0.0; 8.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; 8.0.1; 8.0.1.2; 8.0.1.3; 8.0.1.4; 9.0.0; 9.0.1.0; 9.0.2.0; 8.0.1.5; 9.0.2.1; 9.0.3; 9.0.3.1; 8.0.1.6

References

http://www.ibm.com/support/docview.wss?uid=swg22012329Patch, Vendor Advisory
http://www.securityfocus.com/bid/104476Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128606VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22012329Patch, Vendor Advisory
http://www.securityfocus.com/bid/104476Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128606VDB Entry, Vendor Advisory

Timeline

Published: Jun 6, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-147404.8Cross-site scripting (XSS) vulnerability in GeniXCMS 1.1.0 allows remote authenticated users to inject arbitrary web script or HTML via the CVE-2017-147416.5The ReadCAPTIONImage function in coders/caption.c in ImageMagick 7.0.7-3 allows remote attackers to cause a denial of service (infinite loop CVE-2017-147429.8Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely.CVE-2017-147438.1Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in an XML document to /onvif/device_ser CVE-2017-147446.1UEditor 1.4.3.3 has XSS via the SRC attribute of an IFRAME element.CVE-2017-147457.8The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.29, interpre CVE-2017-147469.8Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.CVE-2017-147485.3Race condition in Blizzard Overwatch 1.15.0.2 allows remote authenticated users to cause a denial of service (season bans and SR losses for CVE-2017-147497.8JerryScript 1.0 allows remote attackers to cause a denial of service (jmem_heap_alloc_block_internal heap memory corruption) or possibly exe CVE-2017-147516.1The Intense WP "WP Jobs" plugin 1.5 for WordPress has XSS, related to the Job Qualification field.CVE-2017-147525.4Mahara 15.04 before 15.04.15, 16.04 before 16.04.9, 16.10 before 16.10.6, and 17.04 before 17.04.4 are vulnerable to a user submitting a pot CVE-2017-147535.4Cross-site scripting (XSS) vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated users to inject a