CVE-2016-5755

NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting...

CVE-2016-5758

A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load...

CVE-2016-5757

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials...

Information disclosure

An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users...

Design/Logic Flaw

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...

CVE-2016-5750

The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...

CVE-2016-5751

An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials...

Information disclosure

Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2...

CVE-2016-5748

External Entity Processing XXE vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users...

CVE-2016-5748

NetIQ Access Manager is affected by an External Entity Processing (XXE) vulnerability in the risk score application. Affected versions: 4.1 prior to 4.1.2 Hot Fix 1 and 4.2 prior to 4.2.2. The issue allows an attacker who can access the application to disclose contents of local files to logged-in...

CVE-2016-1603

An information leak in the NetIQ IDM ServiceNow Driver before 1.0.0.1 could expose cryptographic attributes to logged-in users...

CVE-2016-5750

CVE-2016-5750 affects NetIQ Access Manager’s iManager Certificate Server Management module. A vulnerability in the certificate upload feature in iManager allows uploading JSP pages that execute with the iManager user, enabling remote code execution by a logged-in user. Affected versions are NetIQ...

CVE-2016-5751

CVE-2016-5751 affects NetIQ Access Manager Identity Server SAML processing: an unfiltered finalizer target URL can be exploited to trigger XSS and leak authentication credentials. Affected products/versions: NetIQ Access Manager 4.1 prior to 4.1.2 HF1, and 4.2 prior to 4.2.2. Root cause: unfilter...

CVE-2016-5754

Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2...

CVE-2016-5756

Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl,...

CVE-2016-5755

NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting...

CVE-2016-5756

NetIQ Access Manager is affected by CVE-2016-5756: multiple web tools components are vulnerable to Reflected Cross-Site Scripting, enabling potential session hijack. Vulnerable in NAM 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2; affected endpoints include nps/servlet/frameservice, nps/servlet...

CVE-2016-1603

NetIQ IDM ServiceNow Driver before version 1.0.0.1 exposes cryptographic attributes to logged-in users, enabling information disclosure. The vulnerability is documented in CVE-2016-1603 and described across multiple sources (NVD entry and CNVD entry), indicating an information leak in that driver...

CVE-2016-1597

CVE-2016-1597 affects NetIQ Access Governance Suite 6.0–6.4, where a logged-in user could escalate privileges to administrator. The connected sources confirm the product and flaw class (privilege escalation) but do not provide further technical details such as exact vulnerable component, root cau...

CVE-2016-5755

CVE-2016-5755 affects NetIQ Access Manager; versions 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 are vulnerable to clickjacking due to a missing SAMEORIGIN filter in the "high encryption" setting. The connected documents corroborate this description and identify the affected product and the s...