IBM » Security Access Manager For Web 8.0 Firmware : Security Vulnerabilities, CVEs, Published In 2017 (Information Leak)

IBM Security Access Manager for Web could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniques.

IBM Security Access Manager for Web allows web pages to be stored locally which can be read by another user on the system.

IBM Security Access Manager for Web could allow an unauthenticated user to gain access to sensitive information by entering invalid file names.

IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request.