CVE-2014-5215

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

Improper access control

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

Xxe

nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, relat...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

CVE-2014-5215

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

CVE-2014-5216

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

CVE-2014-5214

The CVE-2014-5214 issue affects NetIQ Access Manager (NAM) 4.x, specifically the iManager Administration Console's nps/servlet/webacc component. It enables an XML External Entity (XXE) injection via a query parameter containing an XML entity declaration, allowing remote authenticated novlwww user...

CVE-2014-5215

NetIQ Access Manager (NAM) 4.x prior to 4.0.1 HF3 is affected by CVE-2014-5215. An authenticated administrator can disclose service-account passwords via requests to roma/jsp/volsc/monitoring/dev_services.jsp or roma/jsp/debug/debug.jsp, constituting an information-disclosure vulnerability (impac...

CVE-2014-5216

NetIQ Access Manager (NAM) 4.x is affected by multiple reflected XSS vulnerabilities (CVE-2014-5216) in NAM prior to 4.0.1 HF3. The issues allow remote attackers to inject arbitrary script via (1) location in dev.Empty to nps/servlet/webacc, (2) error in nidp/jsp/x509err.jsp, (3) lang in sslvpn/a...

CVE-2014-5217

CVE-2014-5217 affects NetIQ Access Manager (NAM) 4.x prior to 4.1. The CSRF in the webacc servlet allows an authenticated admin session to change the administrative password via fw.SetPassword. The vulnerability requires an authenticated administrator and is documented alongside other issues (XXE...

CVE-2014-9412

Technical details for CVE-2014-9412 are not publicly available in the provided documents; monitor for updates.

CVE-2014-9412

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...

CVE-2014-5217

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-5214

nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, relat...

PT-2014-6350

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0.0 through 4.0.1 before HF3 Description The issue allows remote authenticated users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity...

NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP1 Hot Fix 3 CVE number: CVE-2014-5214, CVE-2014-5215, CVE-2014-5216, CVE-2014-5217 impact: High homepage: https://www.netiq.com/ found: 2014-10-29 by: W. Ettlinger...

PT-2014-6352

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.0.1 HF3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in...

PT-2014-6351

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0.0 through 4.0.1 before HF3 Description The issue allows remote authenticated administrators to discover service-account passwords. This can be achieved by sending a request to API endpoints such as...