Security
Sort by:
Trending
Status:
Showing 15
33
VOTE
Support for token authentication
Some of REST APIs for IBM products have token authentication implemented. I.e., call a sign in API to get a token, and then use the token in a HTTP Header for all other API calls.
Example Products:
IBM Sterling Secure Proxy: https://www.ibm.com/su...
3
Planned for future release
8
VOTE
Support Additional methods of smtp authentication
PEM currently only supports basic authentication for SMTP. ( user id, password ). At most, it does allow you to select between smtp and smtps. However, smtp providers have been moving away from basic authentication for some time. PEM does not allo...
1
Future consideration
2
VOTE
Use a whitelist approach to validate the file extension in /dsv/sponsor/module/fileManagement and /dsv/partner/module/fileManagement
The PEM is vulnerable to an unrestricted file upload on the path /dsv/partner/module/fileManagement/ and /dsv/sponsor/module/fileManagement in the parameter file. Through this vulnerability it is possible to upload a windows executable file that t...
3
1
VOTE
Refresh Token provided in HTTP Headers
Current situation: The OpenID Connect refresh token is sent as a GET parameter to the webservers of pem-pp and pem-pr applications so the refresh token is showed in the URL history of the browser/sniffer traffic: Example: GET/rochesso/home?refresh...
0
Under review
1
VOTE
Use Refresh token rotation to make Jwt token more secure
Current Situation: An access token allows temporary access to restricted resources, PEM APIs, and so has a short validity period of 5 minutes (configurable through system properties). A refresh token has a longer validity as it allows users to log...
0
Under review
1
VOTE
Check file upload content with magic bytes
At current situation a malicious user can bypass the file type restrictions for logos in pem-pp application. It is possible to bypass the upload restrictions and upload a disallowed file by changing the file Content-Type to an allowed one. The ser...
0
Under review
5
VOTE
2
VOTE
Ability to add custom HTTP headers for PEM application
Due to security concerns, security team likes to have custom HTTP headers in all HTTP traffic. Request you to please add a new feature is to be able to configure HTTP header for PEM application. This is required to get CA signed certificates from ...
1
Future consideration
5
VOTE
1
VOTE