Security Bulletin: IBM Security Access Manager Appliance has fixed a cross-site scripting vulnerability (CVE-2018-1740)

Summary IBM Security Access Manager Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. Vulnerability...

CapMon Access Manager Access Control Error Vulnerability (CNVD-2019-07543)

CapMon Access Manager is a set of access management software from CapMon Denmark. The software supports application whitelisting/blacklisting, audit logging, and more. An access control error vulnerability exists in the AccessManagerCoreService.exe file in CapMon Access Manager version 5.4.1.1005...

CapMon Access Manager Access Control Error Vulnerability (CNVD-2019-07542)

CapMon Access Manager is a set of access management software from CapMon Denmark. The software supports application whitelisting/blacklisting, audit logging, and more. An access control error vulnerability exists in the AccessManagerCoreService.exe and TaskTrayApplication.exe files in CapMon Acce...

CapMon Access Manager Access Control Error Vulnerability

CapMon Access Manager is a set of access management software from CapMon Denmark. The software supports application whitelisting/blacklisting, audit logging, and more. An access control error vulnerability exists in the CALRunElevated.exe file in CapMon Access Manager version 5.4.1.1005. An...

CapMon Access Manager Access Control Error Vulnerability (CNVD-2019-07541)

CapMon Access Manager is a set of access management software from CapMon Denmark. The software supports application whitelisting/blacklisting, audit logging, and more. An access control error vulnerability exists in the CALRunElevated.exe file in CapMon Access Manager version 5.4.1.1005. An...

CVE-2019-6716

The CVE-2019-6716 issue affects LogonBox Limited/Nervepoint Access Manager (versions 1.2–1.4-RG3; 2013–2017) where an unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core enables an attacker to enumerate internal Active Directory usernames and group names and to alter back-end j...

CVE-2019-6716

An unauthenticated Insecure Direct Object Reference IDOR in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs backup and synchronization jobs, which could...

Design/Logic Flaw

An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this server through named pipes. A user can initiate communication with the server by creating a named pipe and sending commands to achieve elevated privileges...

CVE-2018-18252

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users via the --system option...

Design/Logic Flaw

An issue was discovered in CapMon Access Manager 5.4.1.1005. A regular user can obtain local administrator privileges if they run any whitelisted application through the Custom App Launcher...

Race condition

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, an...

CVE-2018-18256

An issue was discovered in CapMon Access Manager 5.4.1.1005. A regular user can obtain local administrator privileges if they run any whitelisted application through the Custom App Launcher...

CVE-2018-18253

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, an...

CVE-2018-18255

An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this server through named pipes. A user can initiate communication with the server by creating a named pipe and sending commands to achieve elevated privileges...

CVE-2018-18252

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users via the --system option...

CVE-2018-18255

An issue was discovered in CapMon Access Manager 5.4.1.1005. The client applications of AccessManagerCoreService.exe communicate with this server through named pipes. A user can initiate communication with the server by creating a named pipe and sending commands to achieve elevated privileges...

CVE-2018-18253

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe attempts to enforce access control by adding an unprivileged user to the local Administrators group for a very short time to execute a single command. However, the user is left in that group if the command crashes, an...

Design/Logic Flaw

An issue was discovered in CapMon Access Manager 5.4.1.1005. CALRunElevated.exe provides "NT AUTHORITY\SYSTEM" access to unprivileged users via the --system option...

Design/Logic Flaw

An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the calwhitelist table in the Custom App Launcher CAL database, and potentially gain privileges by placing a Trojan horse program at an app pathname...

CVE-2018-18254

An issue was discovered in CapMon Access Manager 5.4.1.1005. An unprivileged user can read the calwhitelist table in the Custom App Launcher CAL database, and potentially gain privileges by placing a Trojan horse program at an app pathname...