Privilege escalation

NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack...

CVE-2018-1344

Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1...

CVE-2018-1347

The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting...

Code injection

Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1...

CVE-2018-1344

Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1...

CVE-2018-1345

NetIQ iManager, versions prior to 3.1, under some circumstances could be susceptible to an elevation of privilege attack...

CVE-2018-1345

NetIQ iManager is affected for versions prior to 3.1, where under some circumstances an elevation of privilege is possible. The issue is documented across multiple sources (NVD/CNVD) with the core description that older iManager releases could allow a user to obtain higher privileges. The exact r...

CVE-2018-1347 NetIQ iManager, versions prior to 3.1, reflected XSS issue

The administrative web interface in NetIQ iManager, versions prior to 3.1, are vulnerable to reflected cross site scripting...

CVE-2018-1344 NetIQ iManager Communication Downgrade Attack

Addresses potential communication downgrade attack in NetIQ iManager versions prior to 3.1...

NetIQ iManager Authentication Vulnerability

NetIQ iManager is a WEB-based application from American NetIQ. You can use wireless devices to manage and configure eDirectory objects. A security vulnerability exists in NetIQ iManager versions prior to 3.0.3 that originates when the program sends an SSL private key from a Java application to...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

Authentication flaw

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

CVE-2017-5189

CVE-2017-5189 affects NetIQ iManager prior to 3.0.3, where a SSL private key was embedded in a Java application (JAR) used to authenticate to the Sentinel appliance. This flaw enables an attacker to extract the private key and establish their own connections to Sentinel. The available sources des...

CVE-2017-5189 private SSL key embedded in JAR file in iManager

NetIQ iManager before 3.0.3 delivered a SSL private key in a Java application JAR file for authentication to Sentinel, allowing attackers to extract and establish their own connections to the Sentinel appliance...

NetIQ iManager Cross-Site Scripting Vulnerability (CNVD-2017-36346)

NetIQ iManager is a WEB-based application from American NetIQ. You can use wireless devices to manage and configure eDirectory objects. A cross-site scripting vulnerability exists in NetIQ iManager versions prior to 2.7.7 Patch 10 HF2 and prior to 3.0.3.2. A remote attacker can exploit this...

CVE-2017-7425

Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2...

CVE-2017-7425

Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2...

Cross site scripting

Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2...

CVE-2017-7425

CVE-2017-7425 corresponds to a cross-site scripting (XSS) vulnerability in NetIQ iManager Web UI. The connected CNVD entry confirms that versions prior to 2.7.7 Patch 10 HF2 and prior to 3.0.3.2 are affected, with a remote attacker able to execute arbitrary JavaScript in the context of the affect...