CVE-2018-1946

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
IBM	Security Identity Governance and Intelligence	5.2; 5.2.1; 5.2.2; 5.2.2.1; 5.2.3; 5.2.3.1; 5.2.3.2; 5.2.4; 5.2.4.1

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/153388VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10872142Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153388VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10872142Patch, Vendor Advisory

Timeline

Published: Feb 21, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-194614.8admin\db\DoSql.php in EmpireCMS through 7.5 allows XSS via crafted SQL syntax to admin/admin.php.CVE-2018-194627.2admin\db\DoSql.php in EmpireCMS through 7.5 allows remote attackers to execute arbitrary PHP code via SQL injection that uses a .php filenam CVE-2018-194638.8zb_system/function/lib/upload.php in Z-BlogPHP through 1.5.1 allows remote attackers to execute arbitrary PHP code by using the image/jpeg c CVE-2018-194644.8Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\default\common\footer.htm mishandles statcode field f CVE-2018-194656.1Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_CVE-2018-194669.8A vulnerability was found in Portainer before 1.20.0. Portainer stores LDAP credentials, corresponding to a master password, in cleartext an CVE-2018-194689.8HuCart 5.7.4 has SQL injection in get_ip() in system/class/helper_class.php via the X-Forwarded-For HTTP header to the user/index.php?load=l CVE-2018-194696.1ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.CVE-2018-19476.1IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerab CVE-2018-194757.8psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack spa CVE-2018-194767.8psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type CVE-2018-194777.8psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode typ