CVE-2018-1956

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

IBM Security Identity Manager 6.0.0 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 153628.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-521

Affected software

Vendor	Product	Versions
IBM	Security Identity Manager	6.0.0

References

http://www.securityfocus.com/bid/106554Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153628VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10794615Patch, Vendor Advisory
http://www.securityfocus.com/bid/106554Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153628VDB Entry, Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10794615Patch, Vendor Advisory

Timeline

Published: Jan 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195608.8BageCMS 3.1.3 has CSRF via upload/index.php?r=admini/admin/ownerUpdate to modify a user account.CVE-2018-195618.8sikcms 1.1 has CSRF via admin.php?m=Admin&c=Users&a=userAdd to add an administrator account.CVE-2018-195628.8An issue was discovered in PHPok 4.9.015. admin.php?c=update&f=unzip allows remote attackers to execute arbitrary code via a "Login Backgrou CVE-2018-195646.1Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters (_ikcf_client and _ikcf_posi CVE-2018-195657.1A buffer over-read in crop_masked_pixels in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an applica CVE-2018-195667.1A heap buffer over-read in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an applic CVE-2018-195675.5A floating point exception in parse_tiff_ifd in dcraw through 9.28 could be used by attackers able to supply malicious files to crash an app CVE-2018-195685.5A floating point exception in kodak_radc_load_raw in dcraw through 9.28 could be used by attackers able to supply malicious files to crash a CVE-2018-195698.8GitLab CE/EE, versions 8.8 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an authorization vulnera CVE-2018-19575.5IBM WebSphere Application Server 9 could allow sensitive information to be available caused by mishandling of data by the application based CVE-2018-195705.4GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown f CVE-2018-195717.7GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability i