Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2025-10280

Incorrect Content Type Cross-Site Scripting Vulnerability

IdentityIQ 8.5, IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p4, IdentityIQ 8.3 and all 8.3 patch levels including 8.3p5, and all prior versions allows some IdentityIQ web services that provide non-HTML content to be accessed via a URL path that will set the Content-Type to HTML allowing a requesting browser to interpret content not properly escaped to prevent Cross-Site Scripting (XSS).

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2026-12341

SailPoint IdentityIQ Improper Bearer Token Validation Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint Sailpoint Technologies
Products
Identityiq Identityiq
CVE-2026-5712

IdentityIQ Role Editor Incorrect Authorization Vulnerability

This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint Sailpoint Technologies
Products
Identityiq Identityiq
CVE-2023-32217

SailPoint IdentityIQ Unsafe use of Reflection Vulnerability

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p3, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p6, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow an authenticated user to invoke a Java constructor with no arguments or a Java constructor with a single Map argument in any Java class available in the IdentityIQ application classpath.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2024-2227

IdentityIQ JavaServer Faces File Path Traversal Vulnerability

This vulnerability allows access to arbitrary files in the application server file system due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950. The remediation for this vulnerability contained in this security fix provides additional changes to the remediation announced in May 2021 tracked by ETN IIQSAW-3585 and January 2024 tracked by IIQFW-336. This vulnerability in IdentityIQ is assigned CVE-2024-2227.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2024-2228

IdentityIQ Authorization of QuickLink Target Identities Vulnerability

This vulnerability allows an authenticated user to perform a Lifecycle Manager flow or other QuickLink for a target user outside of the defined QuickLink Population.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2024-10905

IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability

IdentityIQ 8.4 and all 8.4 patch levels prior to 8.4p2, IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p5, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p8, and all prior versions allow HTTP/HTTPS access to static content in the IdentityIQ application directory that should be protected.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2024-1714

Access Request for Entitlement Values with Leading/Trailing Whitespace

An issue exists in all supported versions of IdentityIQ Lifecycle Manager that can result if an entitlement with a value containing leading or trailing whitespace is requested by an authenticated user in an access request.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2022-45435

SailPoint IdentityIQ Access Control Bypass

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq
CVE-2022-46835

SailPoint IdentityIQ JavaServer File Path Traversal Vulnerability

IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sailpoint
Products
Identityiq