Some of REST APIs for IBM products have token authentication implemented. I.e., call a sign in API to get a token, and then use the token in a HTTP Header for all other API calls.
Example Products:
IBM Sterling Secure Proxy: https://www.ibm.com/su...
PEM currently only supports basic authentication for SMTP. ( user id, password ). At most, it does allow you to select between smtp and smtps. However, smtp providers have been moving away from basic authentication for some time. PEM does not allo...
Use a whitelist approach to validate the file extension in /dsv/sponsor/module/fileManagement and /dsv/partner/module/fileManagement
The PEM is vulnerable to an unrestricted file upload on the path /dsv/partner/module/fileManagement/ and /dsv/sponsor/module/fileManagement in the parameter file. Through this vulnerability it is possible to upload a windows executable file that t...
Current situation: The OpenID Connect refresh token is sent as a GET parameter to the webservers of pem-pp and pem-pr applications so the refresh token is showed in the URL history of the browser/sniffer traffic: Example: GET/rochesso/home?refresh...
Use Refresh token rotation to make Jwt token more secure
Current Situation: An access token allows temporary access to restricted resources, PEM APIs, and so has a short validity period of 5 minutes (configurable through system properties). A refresh token has a longer validity as it allows users to log...
At current situation a malicious user can bypass the file type restrictions for logos in pem-pp application. It is possible to bypass the upload restrictions and upload a disallowed file by changing the file Content-Type to an allowed one. The ser...
Ability to add custom HTTP headers for PEM application
Due to security concerns, security team likes to have custom HTTP headers in all HTTP traffic. Request you to please add a new feature is to be able to configure HTTP header for PEM application. This is required to get CA signed certificates from ...
disablement of ssl protocol versions via configuration
For PEM, there is no option currently to disable ssl protocols which are flagged as a security concern. This leads to ports accepting ssl request for TLS v1 - 1.2 currently.