Information disclosure

This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1...

CVE-2021-22525

This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1...

CVE-2021-22525

NetIQ Access Manager CVE-2021-22525 describes an information-leakage vulnerability in NAM prior to version 5.0.1. The root cause is insufficient privilege controls that can disclose sensitive information (confidentiality impact reported as HIGH in CVSS data). Affected product/component: NetIQ Acc...

CVE-2021-22525

This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1...

Micro Focus NetIQ Access Manager 信息泄露漏洞

Micro Focus NetIQ Access Manager NAM is a resource access control solution from Micro Focus UK. The solution provides multiple authentication, data encryption, single sign-on, and SSLVPN for local and remote users. An information disclosure vulnerability exists in NetIQ Access Manager, which aris...

CVE-2021-22002

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. A malicious actor with network access to port 443 could tamper with host headers to facilitate access to the /cfg web app, in...

CVE-2021-22526

Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4...

CVE-2021-22527

Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4...

CVE-2021-22524

Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4...

The vulnerability of the SAML-based authentication and access control implementation in NetIQ Access Manager allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SAML-based authentication and access control implementation of NetIQ Access Manager is related to insufficient protection of sensitive data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

VulnCheck KEV: CVE-2021-22506

Micro Focus Access Manager contains an information leakage vulnerability resulting from a SAML service provider redirection issue when the Assertion Consumer Service URL is used...

User Rights Access Manager <= 1.0.5 - Access Restriction Bypass

The plugin does not properly restrict access to pages, allowing admin users with restricted access done by the plugin to still access the related pages. The issue is the same technique than https://blog.nintechnet.com/vulnerabilities-fixed-in-wordpress-controlled-admin-access-plugin/ PoC The PoC...

Security Bulletin: Security vulnerabilities have been identified in WebSphere Application Server shipped with IBM Tivoli Access Manager for e-business

Summary WebSphere Application Server is shipped with IBM Tivoli Access Manager for e-business. Information about security vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to a Privilege Escalation vulnerability (CVE-2021-29736)

Summary IBM WebSphere Application Server is shipped with IBM Security Access Manager for Enterprise Single Sign-On. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details CVEID: CVE-2021-29736...

Security Bulletin: A security vulnerability was fixed in IBM Security Access Manager and IBM Security Verify Access Docker containers

Summary A security vulnerability was fixed in IBM Security Access Manager and IBM Security Verify Access Docker containers Vulnerability Details CVEID: CVE-2021-20439 DESCRIPTION: IBM Security Access Manager Docker stores user credentials in plain clear text which can be read by an unauthorized...

Pre-auth RCE in ForgeRock Access Manager (CVE-2021-35464)

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

Oracle Access Manager Multiple Vulnerabilities (Jul 2021 CPU)

The version of Oracle Access Manager installed on the remote host is affected by the following vulnerabilities as noted in the July 2021 CPU advisory : - Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Rest interfaces for Access Mgr. The supported version...

CVE-2021-2358

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Rest interfaces for Access Mgr. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Acces...

CVE-2021-2358

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Rest interfaces for Access Mgr. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Acces...

Design/Logic Flaw

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Rest interfaces for Access Mgr. The supported version that is affected is 11.1.2.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Acces...