CVE-2010-3017: Undefined Security Weakness

Unspecified vulnerability in RSA Access Manager Agent 4.7.1 before 4.7.1.7, when RSA Adaptive Authentication Integration is enabled, allows remote attackers to bypass authentication and obtain sensitive information via unknown vectors...

CVE-2010-3018: Exposure of Sensitive Information to an Unauthorized Actor

RSA Access Manager Server 5.5.3 before 5.5.3.172, 6.0.4 before 6.0.4.53, and 6.1 before 6.1.2.01 does not properly perform cache updates, which allows remote attackers to obtain sensitive information via unspecified vectors...

RSA Access Manager Server / Agent vulnerabilities

Few restriction bypass vulnerabilities...

ESA-2010-014: RSA, The Security Division of EMC, releases security hot fixes for potential vulnerability in RSA® Access Manager Server under certain conditions.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2010-014: RSA, The Security Division of EMC, releases security hot fixes for potential vulnerability in RSA® Access Manager Server under certain conditions. Security Advisory Updated August 31, 2010 Summary: RSA Access Manager Server contains a...

ESA-2010-016: RSA, The Security Division of EMC, releases security hot fix for a potential vulnerability in RSA® Access Manager Agent when working with RSA® Adaptive Authentication.

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2010-016: RSA, The Security Division of EMC, releases security hot fix for a potential vulnerability in RSA® Access Manager Agent when working with RSA® Adaptive Authentication Security Advisory Updated September 2, 2010 Summary: RSA Access Manage...

ZDI-10-136: Novell Teaming ajaxUploadImageFile Remote Code Execution Vulnerability

ZDI-10-136: Novell Teaming ajaxUploadImageFile Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-136 July 21, 2010 -- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C -- Affected Vendors: Novell -- Affected Products: Novell Access Manager -- TippingPointTM IPS Customer...

Design/Logic Flaw

Unspecified vulnerability in the Access Manager / OpenSSO component in Oracle OpenSSO Enterprise 7.1, 7, 2005Q4, and 8.0 allows remote attackers to affect integrity via unknown vectors...

CVE-2009-3763

CVE-2009-3763 affects Oracle OpenSSO/OpenSSO Enterprise (Access Manager) 7.1, 7, 2005Q4, and 8.0. The vulnerability is exposed via HTTP and requires authentication; impact is listed as integrity with partial impact, over a network. The CVE is referenced in Oracle Sun Products Suite documentation ...

CVE-2009-3763: Undefined Security Weakness

Unspecified vulnerability in the Access Manager / OpenSSO component in Oracle OpenSSO Enterprise 7.1, 7, 2005Q4, and 8.0 allows remote attackers to affect integrity via unknown vectors...

Novell 'modulemanager' Servlet Arbitrary File Upload (intrusive check)

The Administration Console component of Novell Access Manager or Novell iManager hosted on the remote web server has an arbitrary file upload vulnerability. Sending a specially crafted multipart POST request to '/nps/servlet/modulemanager' results in the upload of arbitrary data. Specifying a...

Novell 'modulemanager' Servlet Arbitrary File Upload (safe check)

The Administration Console component of Novell Access Manager or Novell iManager running on the remote web server has an arbitrary file upload vulnerability. Sending a specially crafted multipart POST request to '/nps/servlet/modulemanager' results in the upload of arbitrary data. Specifying a...

ZDI-10-112: Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability

ZDI-10-112: Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-10-112 June 21, 2010 -- CVE ID: CVE-2010-0284 -- Affected Vendors: Novell -- Affected Products: Novell Access Manager -- Vulnerability Details: This...

Novell Access Manager Arbitrary File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to upload arbitrary files on vulnerable installations of Novell Access Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PortalModuleInstallManager component of the Novell Management Console which...

CVE-2010-0284

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console aka Access Management Console in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with...

Directory traversal

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console aka Access Management Console in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with...

CVE-2010-0284

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console aka Access Management Console in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with...

CVE-2010-0284

Summary: CVE-2010-0284 affects Novell Access Manager (Administration Console) via the PortalModuleInstallManager in nps.jar. A directory traversal in getEntry allows remote attackers to create arbitrary files and, as a result, execute arbitrary code. This impacts Windows installations of Novell A...

CVE-2010-0284: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console aka Access Management Console in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with...

CVE-2009-4878

Unspecified vulnerability in the Administration Console in Novell Access Manager before 3.1 SP1 allows attackers to access system files via unknown attack vectors...

CVE-2009-4879

The Identity Server in Novell Access Manager before 3.1 SP1 allows attackers with disabled Active Directory accounts to authenticate using X.509 authentication, which bypasses intended access restrictions...