OPM Warned About Vulnerabilities, Governance Weaknesses

It’s hardly a surprise that the U.S. Office of Personnel Management OPM was targeted by nation-state hackers, given the sensitivity of the personal information the office stored. It’s also no shocker that OPM has been successfully infiltrated more than once given the state of its information...

ESA-2015-078: RSA® Identity Management and Governance (IMG) Insecure Password Reset Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2015-078: RSA® Identity Management and Governance IMG Insecure Password Reset Vulnerability EMC Identifier: ESA-2015-078 CVE Identifier: CVE-2015-0532 Severity Rating: CVSSv2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected Products: - RSA...

EMC RSA Identity Management and Governance Unauthorized Access Vulnerability

EMC RSA Identity Management and Governance is an identity management solution. EMC RSA Identity Management and Governance IMG version 6.9 prior to P04 and version 6.9.1 prior to P01 fails to properly restrict password resets, allowing remote attackers to exploit a vulnerability by submitting a...

Default credentials

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

CVE-2015-0532

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

CVE-2015-0532

RSA Identity Management and Governance (IMG) 6.9 before P04 and 6.9.1 before P01 are affected by an insecure password reset vulnerability where a weakness in the password reset process may allow an attacker to gain access by submitting a reset operation for an arbitrary legitimate account name. P...

CVE-2015-0532

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

PT-2015-4696

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Management and Governance IMG versions 6.9 before P04 and 6.9.1 before P01 Description The issue allows remote attackers to obtain access via crafted use of the password reset process for an arbitrary valid account name,...

CVE-2015-0532: Undefined Security Weakness

EMC RSA Identity Management and Governance IMG 6.9 before P04 and 6.9.1 before P01 does not properly restrict password resets, which allows remote attackers to obtain access via crafted use of the reset process for an arbitrary valid account name, as demonstrated by a privileged account...

Government Report Critical of FAA Security Controls

The Federal Aviation Administration has been put on notice that its information security controls are not up to par and that a risk-based program must be implemented from the ground up in order to assure the safety of its networks and passengers in the sky. A scathing Government Accounting Office...

PT-2014-2697

Name of the Vulnerable Software and Affected Versions SAP Governance, Risk, and Compliance GRC affected versions not specified Description The issue allows remote authenticated users to gain privileges and execute arbitrary programs. This can be achieved by sending a crafted request, either via R...

CVE-2013-3678: Undefined Security Weakness

Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance GRC allow remote authenticated users to gain privileges and execute arbitrary programs via a crafted 1 RFC or 2 SOAP-RFC request...

ESA-2014-081 RSA® Identity Management and Governance Authentication Bypass Vulnerability

ESA-2014-081.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ESA-2014-081 RSA® Identity Management and Governance Authentication Bypass Vulnerability EMC Identifier: ESA-2014-081 CVE Identifier: CVE-2014-4619 Severity Rating: CVSS v2 Base Score: 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C Affected products:...

OpenSSL Security Policy Made Public for First Time

OpenSSL has been having a rough go of it for some time thanks to Heartbleed and a handful of other critical vulnerabilities. Not only did those bugs put commerce and communication at risk, but they opened many people’s eyes as to how omnipresent the open source crypto implementation is. In an...

CVE-2014-4619

EMC RSA Identity Management and Governance IMG 6.5.x before 6.5.1 P11, 6.5.2 before P02HF01, and 6.8.x before 6.8.1 P07, when Novell Identity Manager aka NovellIM is used, allows remote attackers to bypass authentication via an arbitrary valid username...

Authentication flaw

EMC RSA Identity Management and Governance IMG 6.5.x before 6.5.1 P11, 6.5.2 before P02HF01, and 6.8.x before 6.8.1 P07, when Novell Identity Manager aka NovellIM is used, allows remote attackers to bypass authentication via an arbitrary valid username...

CVE-2014-4619

RSA IMG (EMC RSA Identity Management and Governance) 6.5.x and 6.8.x are affected when Novell Identity Manager is used, enabling authentication bypass with a valid username. Root cause: authentication bypass due to NovellIM-based setup; no password required for legitimate users. Affected versions...

PT-2014-6026

Name of the Vulnerable Software and Affected Versions EMC RSA Identity Management and Governance IMG versions 6.5.x through 6.5.1 P10 EMC RSA Identity Management and Governance IMG version 6.5.2 through 6.5.2 P01 EMC RSA Identity Management and Governance IMG versions 6.8.x through 6.8.1 P06...

CVE-2014-4619: Improper Authentication

EMC RSA Identity Management and Governance IMG 6.5.x before 6.5.1 P11, 6.5.2 before P02HF01, and 6.8.x before 6.8.1 P07, when Novell Identity Manager aka NovellIM is used, allows remote attackers to bypass authentication via an arbitrary valid username...

CVE-2013-6469

JBoss Overlord Run Time Governance RTGov 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language MVEL expression. NOTE: some of these details are obtained from third party information...