900 matches found
CVE-2016-5750
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user, allowing code execution by logged-in remote users...
CVE-2016-5758
Affected product: NetIQ Access Manager (NAM) 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2. Vulnerability: CSRF protection mechanism can be circumvented by repeated uploads, causing high load. Root cause / impact: The repeated-upload path undermines CSRF defenses, potentially enabling unauthori...
CVE-2016-1597
A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator...
CVE-2016-5758
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load...
CVE-2016-5748
External Entity Processing XXE vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local files to logged-in users...
CVE-2016-5752
The CVE-2016-5752 entry concerns NetIQ Access Manager’s Identity Server SAML2 implementation. Affected versions are 4.1 prior to 4.1.2 HF1 and 4.2 prior to 4.2.2. The issue arises from handling unsigned SAML requests, causing leakage of results to a potentially malicious Assertion Consumer Servic...
CVE-2016-5754
NetIQ Access Manager (NAM) is affected by CVE-2016-5754. The vulnerability is an information disclosure caused by the presence of an ".htaccess" file that could leak sensitive information in NAM versions 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. The CNVD entry confirms a NAM information-disc...
CVE-2016-5752
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially malicious "Assertion Consumer Service URL" instead of the original requester...
CVE-2016-5757
CVE-2016-5757 affects NetIQ Access Manager: iManager Admin Console in NAM 4.1 (before 4.1.2 Hot Fix 1) and 4.2 (before 4.2.2). Root cause is an iFrame manipulation vulnerability that could allow remote attackers to gain access to authentication credentials. The connected sources confirm affected ...
CVE-2016-5749
The vulnerability CVE-2016-5749 affects NetIQ Access Manager. Affected: NAM 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2. Root cause: NAM parses incoming SAML requests with External Entity (XXE) resolution enabled. Impact: potential local file disclosure through XML External Entity injection. Explo...
CVE-2016-5749
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML External Entity XXE attack...
CVE-2016-5751
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak authentication credentials...
CVE-2016-5757
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to authentication credentials...
NetIQ Sentinel Java Object Deserialization RCE
The remote Novell NetIQ Sentinel server is affected by a remote code execution vulnerability due to unsafe deserialize calls of unauthenticated Java objects to the BeanShell library. An unauthenticated, remote attacker can exploit this, by sending a specially crafted serialized Java object via th...
Novell NetIQ Identity Manager Cross-Site Scripting Vulnerability
NetIQ Designer for Identity Manager is a suite of graphical interface tools for configuring and deploying Identity Manager, a comprehensive solution for providing identity and control access, from NetIQ USA. A cross-site scripting vulnerability exists in Novell NetIQ Identity Manager. As the...
Novell NetIQ Identity Manager HTML Injection Vulnerability (CNVD-2016-10657)
NetIQ Designer for Identity Manager is a suite of graphical interface tools for configuring and deploying Identity Manager, a comprehensive solution for providing identity and control access, from NetIQ USA. An HTML injection vulnerability exists in Novell NetIQ Identity Manager. An attacker coul...
Novell NetIQ Identity Manager HTML Injection Vulnerability
NetIQ Designer for Identity Manager is a suite of graphical interface tools for configuring and deploying Identity Manager, a comprehensive solution for providing identity and control access, from NetIQ USA. An html injection vulnerability exists in Novell NetIQ Identity Manager versions prior to...
CVE-2016-1598
XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages...
