CVE-2022-26951

CVE-2022-26951 affects Archer 6.x up to 6.10 (6.10.0.0). The vulnerability is a reflected cross-site scripting (XSS) flaw: a remote, SAML-authenticated Archer user could coax a victim application user into submitting malicious HTML/JavaScript to the vulnerable web app, with the malicious code the...

CVE-2022-26950

Archer 6.x through 6.9 P2 6.9.0.2 is affected by an open redirect vulnerability. A remote unprivileged attacker may potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims' credentials and silently authenticate them to t...

CVE-2022-26950

CVE-2022-26950 affects Archer 6.x through 6.9 P2 (6.9.0.2). The Red Hat and NVD entries corroborate an open redirect vulnerability that could allow a remote, unprivileged attacker to redirect legitimate users to arbitrary sites, enabling phishing and potential credential theft with silent authent...

CVE-2022-26949

Archer 6.x through 6.9 SP2 P1 6.9.2.1 contains an improper access control vulnerability on attachments. A remote authenticated malicious user could potentially exploit this vulnerability to gain access to files that should only be allowed by extra privileges...

CVE-2022-26949

CVE-2022-26949 affects Archer 6.x through 6.9 SP2 P1 (6.9.2.1). The issue is an improper access control on attachments, enabling a remote authenticated attacker to access files that should require higher privileges. Root cause: inadequate access controls on attachment handling. Impact stated: pot...

CVE-2022-26948

The CVE-2022-26948 entry affects the Archer RSS feed integration in Archer 6.x up to 6.9 SP1 (6.9.1.0). The root cause is insecure credential storage, allowing a malicious actor to access credential information and potentially use it for further attacks. The available documents do not provide spe...

CVE-2022-26948

The Archer RSS feed integration for Archer 6.x through 6.9 SP1 6.9.1.0 is affected by an insecure credential storage vulnerability. A malicious attacker may obtain access to credential information to use it in further attacks...

CVE-2022-26947

CVE-2022-26947 is a reflected XSS vulnerability in Archer 6.x through 6.9 SP3 (6.9.3.0). A remote authenticated Archer user could prompt a victim user to submit malicious HTML/JavaScript to the vulnerable web application, with the malicious code then reflected back and executed by the victim’s br...

CVE-2022-26947

Archer 6.x through 6.9 SP3 6.9.3.0 contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the...

PT-2022-18133

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.9 SP3 6.9.3.0 Description The issue is a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

RSA Archer跨站脚本漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. a cross-site scripting vulnerability exists in Archer versions 6.x inclusive through 6.9.3.0 inclusive. A remote attacker could exploit the...

PT-2022-11436

Name of the Vulnerable Software and Affected Versions RSA Archer version 6.9.SP1 P3 Description The issue allows an attacker to bypass precluded application functions by intercepting the API request at the "/api/V2/internal/TaskPermissions/CheckTaskAccess" endpoint. If the parameters of this...

PT-2022-18137

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.10 Description The issue is a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

RSA Archer 安全漏洞

RSA Security RSA Archer is an enterprise IT governance and compliance management product from RSA Security, which includes policy, risk and compliance definition and management. It is capable of aggregating all of our enterprise assets, as well as some of the monitored information, and organizing...

PT-2022-18134

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.9 SP1 6.9.1.0 Description The Archer RSS feed integration is affected by an insecure credential storage issue. A malicious attacker may obtain access to credential information to use it in further attacks...

RSA Archer 安全漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all our enterprise assets, as well as some of the monitored information all together, organized on top of a unified...

RSA Archer安全漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all of our enterprise assets, as well as some of the monitored information, and organize it into a unified platform,...

PT-2022-18136

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.9 P2 6.9.0.2 Description The issue allows a remote unprivileged attacker to potentially redirect legitimate users to arbitrary web sites and conduct phishing attacks. The attacker could then steal the victims'...

RSA Archer 跨站脚本漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK.A cross-site scripting vulnerability exists in Archer versions 6.x inclusive through 6.10 inclusive, which stems from the lack of proper validation of client-side data by WEB applications. A remote attacker...

RSA Archer 输入验证错误漏洞

RSA Archer is an enterprise IT governance and compliance governance product from RSA UK, including policy, risk and compliance definition and management. It is able to aggregate all of our enterprise assets, as well as some of the monitored information, and organize it into a unified platform,...