PT-2017-8764

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions 4.1 through 4.1.2 before Hot Fix 1 NetIQ Access Manager versions 4.2 through 4.2.2 Description The issue is related to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting...

CVE-2016-5752: Exposure of Sensitive Information to an Unauthorized Actor

The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester...

CVE-2016-5750: Improper Access Control

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...

NetIQ Access Manager 4.0 SP1 XXE Injection

Hello list! I'll give you additional information concerning advisory Multiple high risk vulnerabilities in NetIQ Access Manager http://securityvulns.ru/docs31510.html. There are five different vulnerabilities in the advisory. For my attack it's needed to use only one vulnerability, XML External...

NetIQ Access Manager Detect

Binary data netiqaccessmanagerdetect.nbin...

NetIQ Access Manager Detect

Binary data netiqaccessmanagerinstalled.nbin...

NetIQ Access Manager 4.0 < 4.0 SP1 Hotfix 3 Multiple Vulnerabilities

The remote host is running a version of NetIQ Access Manager 4.0 without service pack 1 hotfix 3. It is, therefore, affected by the following vulnerabilities : - An XML Entity Injection XXE flaw exists in the 'query' parameter of the webacc servlet that can allow an authenticated user to view the...

Multiple Cross-Site Scripting Vulnerabilities in NetIQ Access Manager

NetIQ Access Manager is a solution for controlling access to resources from American NetIQ. Multiple cross-site scripting vulnerabilities in NetIQ Access Manager version 4.x prior to 4.1 allow remote attackers to inject arbitrary web script or HTML...

NetIQ Access Manager Directory Traversal Vulnerability

NetIQ Access Manager is a solution for controlling access to resources from American NetIQ. A directory traversal vulnerability in HF3, version 4.x prior to NetIQ Access Manager 4.0.1, allows remotely authenticated novlwww users to read arbitrary files via external entity declarations containing...

CVE-2014-9412

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...

CVE-2014-5217

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-5216

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

CVE-2014-5215

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via 1 the location parameter in a dev.Empty action to nps/servlet/webacc, 2 the error parameter to nidp/jsp/x509err.jsp, 3 the lang...

Xxe

nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query parameter containing an XML external entity declaration in conjunction with an entity reference, relat...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-5217

Cross-site request forgery CSRF vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager NAM 4.x before 4.1 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via an fw.SetPassword...

CVE-2014-5215

NetIQ Access Manager NAM 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to 1 roma/jsp/volsc/monitoring/devservices.jsp or 2 roma/jsp/debug/debug.jsp...

CVE-2014-9412

Multiple cross-site scripting XSS vulnerabilities in NetIQ Access Manager NAM 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via 1 an arbitrary parameter to roma/jsp/debug/debug.jsp or 2 an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a...