CVE-2018-7677

The CVE-2018-7677 entry applies to NetIQ Access Manager (NAM) 4.4 Identity Server component. The vulnerability arises because HTTP requests are not properly validated, creating a cross-site request forgery (CSRF) exposure. This allows an attacker to perform unauthorized operations against the aff...

PT-2018-18203

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager NAM version 4.4 Description A CSRF exposure exists in the Identity Server component. Recommendations For version 4.4, update to a version that includes a fix for this issue...

CVE-2018-7677: Cross-Site Request Forgery (CSRF)

A CSRF exposure exists in NetIQ Access Manager NAM 4.4 Identity Server component...

Identity Server downloadBasicSSOServlet Code Execution

The vulnerability of the downloadBasicSSOServlet component in the Identity Server’s authentication and access control mechanism is related to errors in managing registration data when processing the fileinfo1 parameter. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

NetIQ Access Manager Arbitrary Code Execution Vulnerability

NetIQ Access Manager NAM is a set of resource access control solutions from American NetIQ. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users.Identity Server is one of the authentication servers. A security vulnerability exists i...

Design/Logic Flaw

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803: Undefined Security Weakness

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

CVE-2017-14803

NetIQ Access Manager: CVE-2017-14803 affects Identity Server in NAM 4.3/4.4, where a bug during access to a basic SSO connector and downloading BasicSSO connector plugins on IE11 enables arbitrary code execution on the target system. Impact is described as high/critical in CVE records, with netwo...

CVE-2017-14803

In NetIQ Access Manager 4.3 and 4.4, a bug exists in Identity Server when accessing a basic SSO connector and downloading the BasicSSO connector plugins on IE11 where an attacker can execute arbitrary code on the system...

PT-2017-3502

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.3 through 4.4 Description The issue is related to a bug in the Identity Server component of NetIQ Access Manager when accessing a basic SSO connector and downloading the BasicSSO connector plugins, particularly ...

WSO2 Identity Server XSS Vulnerability

WSO2 Identity Server is prone to a cross-site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Forwarded HTTP Headers

cloudfoundry-identity-server is vulnerable to forwarded http headers. There is an issue with forwarded http headers in UAA that can result in an account being corrupted...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.10.0, <=3.15.0), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.10.0, <=3.15.0) +1 more potentially affected by CVE-2017-4974 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.10.0, <=3.15.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.10.0, =3.10.0, =3.10.0, =3.10.0, =3.15.0 Source cves: CVE-2017-4974 Source advisory: MEND:CVE-2017-4974...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.10.0, <=3.13.0), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.10.0, <=3.13.0) +1 more potentially affected by CVE-2017-4973 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.10.0, <=3.13.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.10.0, =3.10.0, =3.10.0, =3.10.0, =3.13.0 Source cves: CVE-2017-4973 Source advisory: MEND:CVE-2017-4973...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.10.0, <=4.1.0), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.10.0, <=4.1.0) +1 more potentially affected by CVE-2017-4992 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.10.0, <=4.1.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.10.0, =3.10.0, =3.10.0, =3.10.0, =4.1.0 Source cves: CVE-2017-4992 Source advisory: MEND:CVE-2017-4992...

org.cloudfoundry.identity:cloudfoundry-identity-api (>=3.0.0, <=3.3.0), org.cloudfoundry.identity:cloudfoundry-identity-app (>=3.0.0, <=3.3.0) +1 more potentially affected by CVE-2016-3084 via org.cloudfoundry.identity:cloudfoundry-identity-server (>=3.0.0, <=3.3.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.3.0 Source cves: CVE-2016-3084 Source advisory: MEND:CVE-2016-3084...

NetIQ Access Manager Information Disclosure Vulnerability (CNVD-2017-05677)

NetIQ Access Manager provides a simple, secure, and scalable solution to handle all of your web access needs. Whether your users are using a cell phone or laptop to access on-premise or cloud-based services, Access Manager ensures security and provides a single sign-on experience. NetIQ Access...

org.cloudfoundry.identity:cloudfoundry-identity-api (3.4.0), org.cloudfoundry.identity:cloudfoundry-identity-app (3.4.0) +1 more potentially affected by CVE-2016-5016 via org.cloudfoundry.identity:cloudfoundry-identity-server (3.4.0)

org.cloudfoundry.identity:cloudfoundry-identity-server MAVEN version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.cloudfoundry.identity:cloudfoundry-identity-server and may be impacted: - org.cloudfoundry.identity:cloudfoundry-identity-api...