CVE-2024-36455

An improper input validation allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request...

CVE-2024-36456

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file...

CVE-2024-36457

The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint...

CVE-2024-38495 Symantec Privileged Access Manager User Enumeration vulnerability

A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database...

CVE-2024-38495 Symantec Privileged Access Manager User Enumeration vulnerability

A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database...

CVE-2024-38494

Broadcom Symantec Privileged Access Management (PAM) contains a vulnerability that, when exploited by a high-privileged authenticated PAM user, enables remote command execution on the affected PAM system via a specially crafted HTTP request. Affected component appears to be the PAM software itsel...

CVE-2024-38494 Symantec Privileged Access Manager Remote Command Execution vulnerability

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request...

CVE-2024-38494 Symantec Privileged Access Manager Remote Command Execution vulnerability

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending a specially crafted HTTP request...

CVE-2024-38493 Symantec Privileged Access Manager Reflected Cross Site Scripting vulnerability

A reflected cross-site scripting XSS vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to click on a specially crafted link to the PAM UI web interface could potentially execute arbitrary client-side code in the context of PAM UI...

CVE-2024-38493

CVE-2024-38493 is a reflected XSS in Broadcom Symantec PAM: the PAM UI web interface fails to filter/escape user input, allowing a remote attacker to persuade a user to click a crafted link and execute arbitrary client-side code in the PAM UI context. Multiple sources corroborate the vulnerabilit...

CVE-2024-38492

CVE-2024-38492 affects Broadcom Symantec Privileged Access Management (PAM). The issue is a file-upload vulnerability where unauthenticated attackers can upload a crafted PAM upgrade file to achieve remote command execution on the PAM system. Root cause cited across sources is the lack of effecti...

CVE-2024-38492 Symantec Privileged Access Manager Remote Command Execution vulnerability

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file...

CVE-2024-36458

CVE-2024-36458 affects Broadcom Symantec Privileged Access Management (PAM). The available documents confirm that a malicious, low-privileged PAM user can perform server upgrade related actions, indicating a privilege-escalation path within PAM components. The incident description is consistent a...

CVE-2024-36458 Symantec Privileged Access Manager Privilege Escalation vulnerability

The vulnerability allows a malicious low-privileged PAM user to perform server upgrade related actions...

CVE-2024-36457 Symantec Privileged Access Manager Authentication Bypass vulnerability

The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint...

CVE-2024-36457 Symantec Privileged Access Manager Authentication Bypass vulnerability

The vulnerability allows an attacker to bypass the authentication requirements for a specific PAM endpoint...

CVE-2024-36457

CVE-2024-36457 describes an authentication bypass in Broadcom Symantec Privileged Access Management (PAM). The vulnerability allows bypassing authentication on a specific PAM endpoint (CVSSv4 5.3, ADJACENT access, LOW attack complexity, no user interaction required). Connected documents confirm B...

CVE-2024-36456 Symantec Privileged Access Manager Remote Command Execution vulnerability

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file...

CVE-2024-36456 Symantec Privileged Access Manager Remote Command Execution vulnerability

This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a specially crafted PAM upgrade file...

CVE-2024-36456

CVE-2024-36456 affects Broadcom Symantec Privileged Access Management (PAM). A code injection vulnerability allows an unauthenticated attacker to achieve remote command execution on the PAM system by uploading a specially crafted PAM upgrade file. Impact is high (remote code execution, confidenti...