CVE-2018-1962

LowCVSS 3.3/10Last modified Jun 17, 2026

Description

IBM Security Identity Manager 7.0.1 Virtual Appliance does not invalidate session tokens when the logout button is pressed. The lack of proper session termination may allow attackers with local access to login into a closed browser session. IBM X-Force ID: 153658.

Metrics

CVSS 3.0 3.3/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-384

Affected software

Vendor	Product	Versions
IBM	Security Identity Manager	7.0.1

References

http://www.ibm.com/support/docview.wss?uid=ibm10796380Patch, Vendor Advisory
http://www.securityfocus.com/bid/106854Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153658VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10796380Patch, Vendor Advisory
http://www.securityfocus.com/bid/106854Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/153658VDB Entry, Vendor Advisory

Timeline

Published: Feb 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-196204.3ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified page_id.CVE-2018-196216.5server/index.php?s=/api/teamMember/save in ShowDoc 2.4.2 has a CSRF that can add members to a team.CVE-2018-196227.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the MMSE dissector could go into an infinite loop. This was addressed in epan/dissectors/pa CVE-2018-196237.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the LBMPDM dissector could crash. In addition, a remote attacker could write arbitrary data CVE-2018-196245.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the PVFS dissector could crash. This was addressed in epan/dissectors/packet-pvfs2.c by pre CVE-2018-196255.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the dissection engine could crash. This was addressed in epan/tvbuff_composite.c by prevent CVE-2018-196265.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the DCOM dissector could crash. This was addressed in epan/dissectors/packet-dcom.c by addi CVE-2018-196277.5In Wireshark 2.6.0 to 2.6.4 and 2.4.0 to 2.4.10, the IxVeriWave file parser could crash. This was addressed in wiretap/vwr.c by adjusting a CVE-2018-196287.5In Wireshark 2.6.0 to 2.6.4, the ZigBee ZCL dissector could crash. This was addressed in epan/dissectors/packet-zbee-zcl-lighting.c by preve CVE-2018-196297.5A Denial of Service vulnerability in the ImageNow Server service in Hyland Perceptive Content Server before 7.1.5 allows an attacker to cras CVE-2018-196306.1cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI, as demonstrate CVE-2018-196347.5CA Service Desk Manager 14.1 and 17 contain a vulnerability that can allow a malicious actor to access survey information.