CVE-2017-14370

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-8016

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting (XSS) via the Questionnaire ID field, allowing an authenticated attacker to execute arbitrary HTML in the user’s browser session. The issue is addressed in version 6.2.0.5 (per Nessus advisory), which also notes m...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may upload malicious files via attachments to arbitrary paths on the web server. Impact details are provided in the NVD entry (CVSS components present) and related adv...

CVE-2017-14371

CVE-2017-14371 affects RSA Archer GRC Platform before 6.2.0.5. The issue is a reflected cross-site scripting vulnerability via the request URL, allowing an attacker to cause arbitrary HTML execution in the user’s browser within the affected RSA Archer application. The connected sources corroborat...

CVE-2017-14369

RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vulnerability to elevate their privileges and export certain application records...

CVE-2017-8016

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-8025

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

CVE-2017-14372

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-14369

CVE-2017-14369 affects the RSA Archer GRC Platform prior to version 6.2.0.5. A low privileged user may exploit a privilege escalation vulnerability to elevate privileges and export certain application records. The provided documents do not specify the exact root cause or exploit details. A remedi...

CVE-2017-14371

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-8016: Improper Neutralization of Input During Web Page Generation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-8025: Improper Input Validation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by an arbitrary file upload vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to upload malicious files via attachments to arbitrary paths on the web server...

PT-2017-18069

Name of the Vulnerable Software and Affected Versions RSA Archer GRC Platform versions prior to 6.2.0.5 Description The issue allows stored cross-site scripting via the Questionnaire ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser...

CVE-2017-14372: Improper Neutralization of Input During Web Page Generation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting vulnerabilities via certain RSA Archer Help pages. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-14371: Improper Neutralization of Input During Web Page Generation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

CVE-2017-14369: Undefined Security Weakness

RSA Archer GRC Platform prior to 6.2.0.5 is affected by a privilege escalation vulnerability. A low privileged RSA Archer user may potentially exploit this vulnerability to elevate their privileges and export certain application records...

CVE-2017-14370: Improper Neutralization of Input During Web Page Generation

RSA Archer GRC Platform prior to 6.2.0.5 is affected by stored cross-site scripting via the Source Asset ID field. An authenticated attacker may potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application...

PT-2017-13423

Name of the Vulnerable Software and Affected Versions RSA Archer GRC Platform versions prior to 6.2.0.5 Description The issue allows an authenticated attacker to potentially execute arbitrary HTML in the user's browser session within the context of the RSA Archer application through stored...

PT-2017-13424

Name of the Vulnerable Software and Affected Versions RSA Archer GRC Platform versions prior to 6.2.0.5 Description The issue is related to reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the...

PT-2017-13425

Name of the Vulnerable Software and Affected Versions RSA Archer GRC Platform versions prior to 6.2.0.5 Description The issue allows attackers to execute arbitrary HTML in the user's browser session, potentially exploiting reflected cross-site scripting vulnerabilities via certain RSA Archer Help...