Code injection

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The...

CVE-2020-5337

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL redirection vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The...

CVE-2020-5336

CVE-2020-5336 affects Dell EMC RSA Archer versions prior to 6.7.0.1 (6.7 P1). The vulnerability is a URL injection that could allow an unauthenticated attacker to trick a victim application user into executing malicious JavaScript in the context of the web application. Connected documents corrobo...

CVE-2020-5335

RSA Archer (EMC), versions prior to 6.7 P2 (6.7.0.2), is affected by a cross-site request forgery (CSRF) vulnerability. A remote unauthenticated attacker could trick a victim using the application into sending arbitrary requests that execute server-side operations with the victim’s privileges. Th...

CVE-2020-5336

RSA Archer, versions prior to 6.7 P1 6.7.0.1, contain a URL injection vulnerability. An unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious JavaScript code on the affected system...

CVE-2020-5335

RSA Archer, versions prior to 6.7 P2 6.7.0.2, contain a cross-site request forgery vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to send arbitrary requests to the vulnerable application to perform server...

CVE-2020-5337

RSA Archer is affected by a URL redirection vulnerability (CVE-2020-5337) in versions prior to 6.7 P1 (6.7.0.1). An unauthenticated remote attacker can lure users to malicious sites by sending crafted links, enabling phishing through redirection. The issue is documented across multiple sources co...

CVE-2020-5334

RSA Archer versions prior to 6.7 P2 (6.7.0.2) are affected by a DOM-based cross-site scripting vulnerability. An unauthenticated remote attacker could exploit this by inducing a victim user to submit malicious HTML/JavaScript to the DOM in the browser, causing code to execute in the context of th...

CVE-2020-5334

RSA Archer, versions prior to 6.7 P2 6.7.0.2, contains a Document Object Model DOM based cross-site scripting vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM...

CVE-2020-5333

RSA Archer, versions prior to 6.7 P3 6.7.0.3, contain an authorization bypass vulnerability in the REST API. A remote authenticated malicious Archer user could potentially exploit this vulnerability to view unauthorized information...

CVE-2020-5333

The CVE-2020-5333 entry concerns RSA Archer before version 6.7 P3 (6.7.0.3) and before 6.6 P6 (6.6.0.6), which contains an authorization bypass vulnerability in the REST API. A remote authenticated Archer user could potentially view unauthorized information due to this flaw. Connected sources cor...

CVE-2020-5332

RSA Archer, versions prior to 6.7 P3 6.7.0.3, contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could potentially exploit this vulnerability to execute arbitrary commands on the system where the vulnerable application is deployed...

CVE-2020-5331

RSA Archer, versions prior to 6.7 P3 6.7.0.3, contain an information exposure vulnerability. Users’ session information could potentially be stored in cache or log files. An authenticated malicious local user with access to the log files may obtain the exposed information to use it in further...

CVE-2020-5332

CVE-2020-5332 affects EMC RSA Archer versions prior to 6.7 P3 (6.7.0.3), with a command-injection vulnerability that an authenticated administrator can exploit to run arbitrary commands on the host running RSA Archer. According to NVD, this has a CVSS v3.1 base score of 7.2 (HIGH) , using a netwo...

CVE-2020-5331

RSA Archer contains an information exposure vulnerability in versions prior to 6.7 P3 (6.7.0.3). Affected component is the application’s handling of session data cached/logged by the server, which could allow an authenticated local user with access to log files to obtain sensitive information. Th...

openssl: information disclosure in PKCS7_dataDecode and CMS_decrypt_set1_pkey

In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of messages to be decrypted, can recover a CMS/PKCS7 transported encryption key or decrypt any RSA encrypted message that was encrypted...

EMC RSA Authentication Manager < 8.4 P11 XSS Vulnerability (DSA-2020-066)

The version of EMC RSA Authentication Manager running on the remote host is prior to 8.4 Patch 11. It is, therefore, affected by stored cross-site scripting vulnerability in the Security Console. A authorized remote user could exploit this vulnerability to store arbitrary HTML or JavaScript code...

EulerOS Virtualization 3.0.2.2 : openssl (EulerOS-SA-2020-1444)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for...

EulerOS Virtualization 3.0.2.2 : libgcrypt (EulerOS-SA-2020-1498)

According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext...

Huawei EulerOS: Security Advisory for libgcrypt (EulerOS-SA-2020-1498)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...