PT-2014-6353

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM versions 4.0 through 4.1 Description A cross-site request forgery CSRF issue exists in the Administration Console server, specifically in the nps/servlet/webacc component. This allows remote attackers to hijack the...

CVE-2014-5216: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities

NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple high risk vulnerabilities product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP...

CVE-2014-5215: Exposure of Sensitive Information to an Unauthorized Actor

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

PT-2014-8997

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.1 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via an...

CVE-2014-5217: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities

Exploit for jsp platform in category web applications product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP1 Hot Fix 3 CVE number: CVE-2014-5214, CVE-2014-5215, CVE-2014-5216, CVE-2014-5217 impact: High homepage: https://www.netiq.com/ found: 2014-10-29 by: W. Ettlinger...

PT-2014-6352

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 4.0.1 HF3 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters in...

NetIQ Access Manager 4.0 SP1 - Multiple Vulnerabilities

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple high risk vulnerabilities product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP1 Hot Fix 3 CVE number: CVE-2014-5214, CVE-2014-5215,...

NetIQ Access Manager multiple security vulnerabilities

XXE, CSRF, XXS, information leakage...

SEC Consult SA-20141218-2 :: Multiple high risk vulnerabilities in NetIQ Access Manager

SEC Consult Vulnerability Lab Security Advisory 20141218-2 ======================================================================= title: Multiple high risk vulnerabilities product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP1 Hot Fix 3 CVE number: CVE-2014-5214,...

Micro Focus / NetIQ Access Manager Detection (HTTP)

HTTP based detection of Micro Focus / NetIQ Access Manager. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

NetIQ Access Manager 4.0 SP1 XSS / CSRF / XXE Injection / Disclosure

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple high risk vulnerabilities product: NetIQ Access Manager vulnerable version: 4.0 SP1 fixed version: 4.0 SP1 Hot Fix 3 CVE number: CVE-2014-5214, CVE-2014-5215,...

NetIQ Access Manager < 4.0 SP1 Hot Fix 3 Multiple Vulnerabilities - Active Check

NetIQ Access Manager suffers from cross-site request forgery CSRF, XML external entity XXE injection, information disclosure, and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2014-6089

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service disrupted system operations by uploading a file to a protected area...

CVE-2014-6088

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to obtain sensitive information by sniffing the network during use of the null SSL cipher...

CVE-2014-6087

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak algorithm in an SSL cipher suite...

CVE-2014-6086

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not ensure that HTTPS is used, which allows remote attackers to obtain sensitive information by sniffing the network during an HTTP session...

CVE-2014-6084

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 make it easier for remote attackers to obtain sensitive information by sniffing the network during use of a weak SSL cipher...

CVE-2014-6082

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service administration UI outage via unspecified vectors...