CVE-2017-14369

RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vulnerability to elevate their privileges and export certain application records...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may upload malicious files via attachments to arbitrary paths on the web server. Impact details are provided in the NVD entry (CVSS components present) and related adv...

CVE-2017-14371

CVE-2017-14371 affects RSA Archer GRC Platform before 6.2.0.5. The issue is a reflected cross-site scripting vulnerability via the request URL, allowing an attacker to cause arbitrary HTML execution in the user’s browser within the affected RSA Archer application. The connected sources corroborat...

CVE-2017-14369

CVE-2017-14369 affects the RSA Archer GRC Platform prior to version 6.2.0.5. A low privileged user may exploit a privilege escalation vulnerability to elevate privileges and export certain application records. The provided documents do not specify the exact root cause or exploit details. A remedi...

CVE-2017-8016

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting (XSS) via the Questionnaire ID field, allowing an authenticated attacker to execute arbitrary HTML in the user’s browser session. The issue is addressed in version 6.2.0.5 (per Nessus advisory), which also notes m...

CVE-2017-14370

CVE-2017-14370 concerns RSA Archer GRC Platform versions prior to 6.2.0.5. The vulnerability is a stored cross-site scripting (XSS) via the Source Asset ID field, allowing an authenticated attacker to cause arbitrary HTML execution in a user’s browser session within the affected application. The ...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

CVE-2017-14372

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via RSA Archer Help pages. An attacker could execute arbitrary HTML in a user’s browser session in the context of the affected application. Affected product/version: RSA Archer GRC Platform < 6.2.0.5. Root c...

EMC RSA Archer GRC Platform Cross-Site Scripting Vulnerability (CNVD-2017-32998)

EMC RSA Archer GRC Platform is an enterprise IT governance and compliance governance product from EMC Corporation USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. A cross-site scripting vulnerability exists in EMC RSA...

RSA Archer GRC 6.2.0.5 XSS / File Upload / Privilege Escalation Vulnerabilities

RSA Archer GRC version 6.2.0.5 suffers from cross site scripting, privilege escalation and remote file upload vulnerabilities. ESA-2017-111: RSA Archerr GRC Platform Multiple Vulnerabilities EMC Identifier: ESA-2017-111 CVE Identifier: CVE-2017-8016, CVE-2017-8025, CVE-2017-14369, CVE-2017-14370,...

Save Time by Streamlining Vendor Risk Assessments in the Cloud

As your organization enthusiastically adopts cloud and mobile services from multiple new vendors, are your already-busy security and compliance teams scrambling to assess the risks of using these new providers’ products? Are you still using a manual process for conducting these vendor evaluations...

eramba Enterprise / Community Cross Site Scripting

Exploit Title: eramba Enterprise & Community Editions Stored XSS Author: Yunus YILDIRIM Th3GundY Team: CT-Zer0 @CRYPTTECH - https://www.crypttech.com Website: www.yunus.ninja Contact: [email protected] 1. ADVISORY INFORMATION ======================= Product: eramba Open-Source IT GRC...

grc-contact.fr XSS vulnerability

Open Bug Bounty ID: OBB-181466 Description| Value ---|--- Affected Website:| grc-contact.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

Design/Logic Flaw

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

CVE-2016-0899

EMC RSA Archer GRC 5.5.x before 5.5.3.4 allows remote authenticated users to read the web.config.bak file, and obtain sensitive credential information, by modifying the IIS configuration to set a Content-Type header for .bak files...

CVE-2016-0899

CVE-2016-0899 affects EMC RSA Archer GRC 5.5.x before 5.5.3.4. Affects web application where remote authenticated users can read the web.config.bak file by altering IIS to set a Content-Type header for .bak files, enabling access to sensitive credential information. Root cause: improper handling ...

CVE-2015-5049

SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...

CVE-2015-5049

SQL injection vulnerability in the API in IBM OpenPages GRC Platform 7.0 before 7.0.0.4 IF3 and 7.1 before 7.1.0.1 IF6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors...