Cross site scripting

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

CVE-2017-5191

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

CVE-2017-5191

NetIQ Access Manager (NAM) versions 4.2 and 4.3 contain a cross-site scripting (XSS) vulnerability in the /NAGErrors URI. The issue arises because the Access Gateway Error page does not validate the HTTP Referer header, enabling a remote attacker to inject arbitrary web script or HTML. No exploit...

PT-2017-16376

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.2 through 4.3 Description A security issue exists due to the lack of validation of the HTTP Referer header in Access Gateway Error pages on the "/NAGErrors" URI. This allows for a potential security risk...

CVE-2017-5191: Improper Neutralization of Input During Web Page Generation

An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header...

CVE-2017-5183

NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document...

CVE-2017-5183

NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document...

CVE-2017-5183

NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document...

CVE-2017-5183

NetIQ Access Manager is affected: versions 4.2.2 and 4.3.x prior to 4.3.1+ contain an XSS flaw in the AssertionConsumerServiceURL field of a signed samlp:AuthnRequest when acting as Identity Server. The root cause is a cross-site scripting vulnerability in that URL field within the AuthnRequest. ...

CVE-2017-5190

NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile...

Improper access control

NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile...

CVE-2017-5190

NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile...

PT-2017-16375

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.2 before SP3 HF1 and 4.3 before SP1 HF1 Description The issue is related to a concurrency problem that causes information leakage when NetIQ Access Manager is configured as a SAML 2.0 Identity Server with Virtua...

PT-2017-16370

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.2.2 through 4.3.0 Description The issue is related to a Cross-Site Scripting XSS problem in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document, specifically when NetI...

CVE-2017-5190: Exposure of Sensitive Information to an Unauthorized Actor

NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile...

CVE-2017-5183: Improper Neutralization of Input During Web Page Generation

NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document...

NetIQ Access Manager Clickjacking Vulnerability

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A clickjacking vulnerability exists in NetIQ Access Manager. A remote attacker could exploit this...

NetIQ Access Manager Cross-Site Scripting Vulnerability (CNVD-2017-04960)

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. A cross-site scripting vulnerability exists in NetIQ Access Manager NAM. A remote attacker can...

NetIQ Access Manager Access Authentication Credentials Vulnerability

NetIQ Access Manager NAM is a set of resource access control solutions from NetIQ Corporation. The solution provides multiple authentication, data encryption, single sign-on, and SSL VPN for local and remote users. iManager Admin Console is one of the back-end management consoles. A security...

NetIQ Access Manager Information Disclosure Vulnerability (CNVD-2017-04919)

NetIQ Access Manager NAM is a resource access control solution from NetIQ, USA. The solution provides multiple authentication, data encryption, single sign-on and SSL VPN for local and remote users. An information disclosure vulnerability exists in the NetIQ Access Manager '.htaccess' file. An...